up vote 0 down vote favorite
share [g+] share [fb]

How to find out if someone viewed or copied data from my mac

link|improve this question
3  
You can't. It's just a program accessing files, and this happens dozens of times every second. Collecting and storing that data would fill your disk in an afternoon. – Daniel Beck Jan 11 '11 at 6:06
1  
This is especially true if they had physical access to your machine. It's a well-known rule that physical access to a machine is the same as full ownership of it and the data thereon. – Randolph West Jan 11 '11 at 8:01
feedback

1 Answer

up vote 0 down vote

Generally, no. There may be specific times when you can - for instance, if you are running a web server and have set it to log every GET request - but in general, as Daniel Beck says, there are far too many programs reading far too many files to log everything.

I don't know when or how you suspect that someone got access to your Mac, but you're better off securing your Mac to prevent people accessing it in the first place. Make sure your password is strong, set your Mac to require a password when the screen saver activates ('Security' section of System Preferences - set a hot corner too so you can activate the screen saver quickly if you want to walk away from your Mac) and turn off file sharing, remote login (ssh) and web sharing if you're not using them ('Sharing' section of System Preferences).

As Randolph Potter says, though, if someone has physical access of the machine and enough time they should be considered to have access to everything on it no matter what security measures you have in place. If you know you're going to have to put your Mac in such a situation (for instance, it has to go in to a repair shop), move anything sensitive onto an external drive and make sure it's thoroughly deleted from your Mac before you send it off.

link|improve this answer
Regarding that last bit: Since we're talking OS X, I suggest keeping all your stuff in your home directory, use FileVault encryption, and create another (unencrypted) admin account for maintenance purposes only. – Daniel Beck Jan 11 '11 at 11:49
Thanks for the info, I just forgot my laptop somewhere for an hour or so... maybe it is not a problem, after all...This info is very helpful and i will certainly keep thing under control in the future – George Jan 11 '11 at 16:45
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.