Is there a way to check the computers activity log to see if a friend copied confidential files from my computer to his external device?
Machine is running macOS Sierra 10.12.4
MacBook Air (13-inch, Early 2015), macOS Sierra (10.12.4)
About all you can do is look for mount and unmount log entries. Such as these for a flash drive I have named as 32 GB Flash.
4/24/17 11:58:57.000 AM kernel[0]: hfs: mounted 32 GB Flash on device disk3s2
4/24/17 11:59:21.000 AM kernel[0]: hfs: unmount initiated on 32 GB Flash on device disk3s2
There were some other items in between these, but nothing to do with the file I copied to the drive. So while you can look for a device that was mounted and unmounted with time stamps that don't coincide with when you were using your Mac, the logs don't appear to make any note of a file action, much less file names.
There are corporate management tools to restrict this which come under the general heading of 'DLP' aka Data Loss Prevention. These would prevent using external storage devices such as USB drives. At least on the PC side such tools usually have the ability to request and use a temporary password to unlock access from management.
The problem is most of these are Windows only. Profile Manager and similar MDM solutions can block use of USB i.e. external storage including CD/DVD burners, however in terms of a DLP type product the only one I have seen with Mac support is the following.
https://www.endpointprotector.com/solutions/data-loss-prevention-DLP-for-Mac-OS- X
https://www.endpointprotector.com/solutions/usb-lockdown-for-mac
way to tell if someone copied files to external device
