Think i got hacked - at my terminal
 

Hi

I think i've recently been hacked, in the sense that someone has been using my computer and copied some files.

Im using Mac OS. I was out all day and when i came back one of my contracts was open in Word. I went into view > order by last opened and saw that many folders had been opened, but no actual files (apart from the one mentioned).

So, because no files had been opened, i assume they actually copied the files to a drive or USB stick.

Is there a way of checking if anything was copied, or if any other USB drives had been used?

Or are there anymore detailed MacOS logs?

Cheers

Rich

I was frikkin sure this thread was also about fallout 4.......

https://richardbrenneman.files.wordp...mac-attack.jpg

Was your monitor also missing?

No lol.

I work in a shared office. - I use a 32 inch TV, and when i left, instead of turning the computer off i just hit power off monitor.

It my own fault, i just want to know if there is any way of checking if any of the files were actually taken.

were you logged in without the screen lock on?

~$ stat [/path/file]
example: I just opened the file now!

copy would not show here
But that is GNU/LINUX
but Apple is proprietary UNIX -- same or similar CLI command in terminal?

Also check your logs for logins if the screen was locked

~$ tac /var/log/auth.log
or similar (again GNU/LINUX path)