Well, two things my curious self wants to ask. It still is not clear how they turned "her internet" off. Did they drop the computer from her network or did they disable her modem? Because if they dropped the computer off her home network, they would have to get back onto the computer to reverse it, and if it is off, you could only bring it back on locally, not remotely.

Second, if you touch ANY file in any way it will change the date. That date says "last modified". If you went to the file called "richard" and changed the name to "richardd" and then back, it would look like you actually change the date when all you did was took SOME action to the file and the computer saw it as a modification. Moving it would also be viewed by the computer as it being modified, also resulting in that date being changed.

For remote use, just for FYI reasons, always use something like join.me because it is a two sided handshake, where one side has to provide a code (I think they use a format of xxx-xxx-xxx) and one side can't just brute force slam into a computer. The number changes with every session so there is no using a code form a previous session.

As far as the social engineering, what I meant was that scammer called her ISP and social engineered the ISP into believing they were calling on her behalf and got the signal shut down from the ISP to her house. Again, more definition is needed to know what you mean by "shut her internet off". Did the link light on her ISP provided box go out, or the connection on the computer? Those would be to very different circumstances, like turning the gas off at you gas meter or the city turning it off under the street so nothing is feeding the gas meter.

It doesn't matter until she gets that call again, and she will, because the caller side has not a care about anything but getting into target's wallets. All the security in the world won't stop a determined enough hacker. With my demeanor, I LOVE getting calls like that! Between that one, the expiring car warranty one, and the one claiming to be the IRS, that's about all the entertainment I need! What makes it sad is that people fall for it, despite it being stated everywhere that the IRS will NEVER call you. They want paper trails so if you do have a tax problem notice will come via certified mail. I kept the car warranty guy going for over twenty minutes one time!