ln tracing the activity of a file in a Mac OS, I saw on one file which showed that it was opened and modified yesterday.
I did not use my computer at all yesterday. It was shutdown.
So does it mean someone accessed my computer remotely?
-
Has your pc been in sleep mode yesterday or was is really turned off?– davidbOct 10, 2015 at 21:30
-
It was shut down completely.– user7149Oct 10, 2015 at 21:31
-
Is it a system file or a file that has been created by you?– davidbOct 10, 2015 at 21:32
-
It was a Word document which I created.– user7149Oct 10, 2015 at 21:32
-
Where do you get the change date from? Filesystem or from the metadata of the document?– davidbOct 10, 2015 at 21:33
|
Show 6 more comments
1 Answer
If your Mac was shutdown yesterday, then no file could have been really modified yesterday (neither locally nor remotely). Your file were modified, but neither yesterday nor remotely.
The origin of your problem is a wrong setting of time (either the time itself i.e. GMT, or the timezone). Hence an event dated as ocuring yesterday might have happened in fact the day before or today, or even on a completly different year.
This explain also events dated on 1969.
You should investigate this completly different problem, because a wrong time may cause a lot of errors on any system, and not only just date where file were modified.
-
where would I go to check the time settings on my system? I'm looking at my time now and it looks correct. If I save a file now, it'll save it with the correct time.– user7149Oct 10, 2015 at 22:12
-
This is a completly different question, and I advise you to start such a question with a right title. For example: "How to invistigate time problem on MacOS X". The best discussion group to ask this question is: apple.stackexchange.com .– danOct 10, 2015 at 22:14
-
2You have nor and neither reversed. – user305408Oct 11, 2015 at 14:46