someone broke into my office. My laptop is still there. Is there a way to find out if they used my computer? It was turned on and I was logged in.
In Terminal, type in last and hit the return key. Once you ascertain when the login occurred quit the Terminal app. Note last also reports any Terminal sessions as tty, so you can probably ignore any of them.
this shows when my mac was rebooted, but since it was turned on the whole weekend I would need to know if someone woke it up during this period, and even if that person did anything to my files!
You could look thru the log files but they may not reveal much. Open the Console.app and look at the Console Messages, /var/log/system.log and any archived system.logs, and the secure.log.
Thanks Mark, I could see that the intruder indeed opened my mac for 20 seconds. I don't think they did anything to my files, but at least we now know exactly what time the crime happened.
Thanks for the feedback. Appears you need to disable autologin and start logging off anytime you leave the machine unattended. That usually precludes casual intruders from accessing the machine.
I'm going to suggest that you contact your law enforcement agency and ask them if your hard drive should be imaged or cloned for evidence.
Retrieving data ...