One of the non-administrator accounts on my mac-book has been compromised. The password to the account has been reset, and I noticed some suspicious looking activity (the user was logged on to my machine, when I had not logged it in).
Since the account is non-root/non-administrator, and has carefully controlled access permissions, there isn't too much likely damage to my machine. That said, there's still some data within the account, which I would like to recover.
So far, I've been thinking of removing the account from my machine, while keeping the users's data, and creating a new account with read-only permissions. As I find myself requiring access to the old users' data, I can transfer it over to the new user, and eventually delete any traces of the old.
Is this safe? Am I missing anything obvious that I should be doing, safety wise?
A friend recommended that I backup the machine, and then re-os it, but that seems a bit excessive.