6 Replies Latest reply: Nov 30, 2012 5:51 AM by Mark Jalbert
lunch2012 Level 1 Level 1 (0 points)

someone broke into my office. My laptop is still there. Is there a way to find out if they used my computer? It was turned on and I was logged in.


MacBook Pro, Mac OS X (10.6.8)
  • 1. Re: access log?
    baltwo Level 9 Level 9 (60,115 points)

    In Terminal, type in last and hit the return key. Once you ascertain when the login occurred quit the Terminal app. Note last also reports any Terminal sessions as tty, so you can probably ignore any of them.

  • 2. Re: access log?
    lunch2012 Level 1 Level 1 (0 points)

    Thanks baltwo,

     

    this shows when my mac was rebooted, but since it was turned on the whole weekend I would need to know if someone woke it up during this period, and even if that person did anything to my files!

  • 3. Re: access log?
    Mark Jalbert Level 5 Level 5 (4,475 points)

    You could look thru the log files but they may not reveal much. Open the Console.app and look at the Console Messages, /var/log/system.log and any archived system.logs, and the secure.log.

  • 4. Re: access log?
    lunch2012 Level 1 Level 1 (0 points)

    Thanks Mark, I could see that the intruder indeed opened my mac for 20 seconds. I don't think they did anything to my files, but at least we now know exactly what time the crime happened.

  • 5. Re: access log?
    baltwo Level 9 Level 9 (60,115 points)

    Thanks for the feedback. Appears you need to disable autologin and start logging off anytime you leave the machine unattended. That usually precludes casual intruders from accessing the machine.

  • 6. Re: access log?
    Mark Jalbert Level 5 Level 5 (4,475 points)

    I'm going to suggest that you contact your law enforcement agency and ask them if your hard drive should be imaged or cloned for evidence.