crabpaws

Q: How can I list all files touched on a particular date?

I'm researching potentially suspicious activity on my Mac, such as installation of a keylogger. How can I see a list of all files touched (not necessarily modified) on a particular date or a particular time window?

 

(At the time of the suspicious activity, I was running Yosemite. I installed El Capitan right after.)

 

I'd want to see all files touched, including files that might have been installed in applications or the system, including invisible files. If I could restrict those that might be launched in system booting, all the better.

 

I know Unix has a way to list all files touched. Can I do this through terminal? What is the command?

Mac mini, OS X Yosemite (10.10.1)

Posted on Jun 22, 2016 1:50 PM

Close

Q: How can I list all files touched on a particular date?

  • All replies
  • Helpful answers