Ask Different is a question and answer site for power users of Apple hardware and software. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

So when I checked my computer this morning I had Terminal open saying:

Last login: Sat Mar 5 00:02:43 on ttys000

I checked uptime and it's been up 27 days, 2 users as usual.

Now I know for a fact that at that precise time I had left my laptop in someone's room for a couple of hours and when I looked through history, I found these commands were most recent (pretty sure it was not me as i recall the previous set):

cd ~/Library
cd Messages/
l
ls
cd Archive
cd ~
exit

When I repeated the commands I got as far as producing

Attachments chat.db chat.db-shm chat.db-wal

But past that I can't trace or understand what the next command did. Tried to change the history log to show date/time stamps on the history logs but they all just came out as today's date, I guess because I only just applied the format to it now.

I'm not a programmer, know v v little about any of this. Got as far as that ^ through Google. Could someone please explain what those commands most likely did, and whether I'm being paranoid in suspecting that said person has tried to export my messages? The last previous command set (which I was there for) had ended in an archive of my most recent Pages work being sent over to somebody via iMessage - could that have been it? Just a bit weird because there was an "exit" just before this set, so it seems like somethings separate ... + I still can't explain the 00:02 login this morning..... Is there a way to prove the worst, if it is so?

Thank you!

share|improve this question

The commands you listed in your question take you into the currently logged in user's Messaging App's message archive, lists the contents of that directory and then goes back to the currently logged in user's home directory. If you were logged in, then it's your messaging archive.

The exit command exits, or closes, the Terminal session, nothing more.

To see who has logged into your computer (or when the last time you logged in from where), type the command last in your Terminal:

$ last

To get a listing of the commands you have executed type:

$ history

If you want to save that to a file for later reading, type this:

$ history > ~/Desktop/history.txt

and a file will show up on your Desktop with all those commands. You can use the same technique for last but be sure to rename the file.

Now, if you want to see what happens when you are not in front of your Mac, just clear out the history before you leave with the command history -c. This way, you will see exactly what has been done when you weren't around.

Now, you obviously have a 2AM login into your computer. Why

a) do you not have a password

or

b) if you do have one, why is it shared with others?

share|improve this answer
    
It's my boyfriend. I do have a password, I didn't realise he knew it. – Vittoria567 Mar 5 at 12:54
    
I went onto console and saw there were 2 sessions - he's admitted to going through iMessages and photos but there was a second session with some weird activity which I thiiiiink involved AirPort - can't get my head around it, is there a way I can show you the console data for that 10 min session? I presume just copy paste dumping it on here is probably not ideal aha – Vittoria567 Mar 5 at 12:56
    
Oh and sorry, and thank you for the fast response – Vittoria567 Mar 5 at 12:57
    
I'll update my answer.... – Allan Mar 5 at 12:59
    
Okay I've uploaded the console log onto txt.do/5vg7v – Vittoria567 Mar 5 at 13:04

You can infer two facts that might be helpful:

First, the login was from ttys000. This means that the login was not via the network, but local. Second, since there is a typo in the commands ("l" instead of "ls") it certainly was a human typing these commands, and not a script.

So the question should be: who has physical access to your computer?

share|improve this answer
    
Thank you! Pls see below (sorry I'm new to this site) – Vittoria567 Mar 5 at 12:56

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.