Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Someone had access to my machine while I was away on vacation and I'd like to know what was installed or copied to my hard drive during a limited 3 day timeframe. Is this system info available? I didn't know if time machine would provide any info.

share|improve this question

migrated from stackoverflow.com May 2 '13 at 16:37

This question came from our site for professional and enthusiast programmers.

add comment

4 Answers

You could also use Spotlight:

mdfind 'kMDItemLastUsedDate>=$time.iso(2013-04-29T00:00Z)'

kMDItemFSContentChangeDate and kMDItemFSCreationDate would be normal modification and creation times.

InstallHistory.plist is a log of installed packages:

cat /Library/Receipts/InstallHistory.plist

This shows files added in the second snapshot:

tmutil compare 2013-02-24-105019 2013-02-26-184354 | grep ^+
share|improve this answer
add comment

You 'could' do a recursive ls -a and grep everything with modified dates in the 3 days and matches the ".app" regex for finding applications

share|improve this answer
add comment

You have a couple options, all of which invlove using Terminal (Applications->Utilities->Terminal).

Option 1

In a terminal window, create two files via the touch command with the date range you want to search. The touch command with the -t option allows us to create a file with an arbitrary creation timestamp(yyyymmddhhmm):

touch -t 201201010000 /tmp/start
touch -t 201201040000 /tmp/end

Now, you use these files to run a find command checking for files on your system that were modified in the desired date range:

find / -newer /tmp/start -a ! -newer /tmp/end -print0 | xargs -0 ls -ld

This will take a bit to run, so you can just leave it be and go about your business, as long as your date range doesn't include today.

Option 2

Run a find command that looks only for files accessed or modified within a certain number of days.

find / -atime -30 -type -f # is a file and was accessed within the last 30 days
find / -mtime -30 -type -f # is a file and was modified within the last 30 days

You could check for directories separately by changing -type -f to -type -d

share|improve this answer
add comment

You can of course use a spotlight search in a finder window of your harddrive and see the files by using 'date modified' twice. That would be the date modified after and the date modified before. You can then save the search to adjust other parameters as well, for example checking only for applications, folders and what have you. This is of course less elaborate than using the Terminal, but using the graphic interface can provide a quick idea.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.