So when I checked my computer this morning I had Terminal open saying:

Last login: Sat Mar 5 00:02:43 on ttys000

I checked uptime and it's been up 27 days, 2 users as usual.

Now I know for a fact that at that precise time I had left my laptop in someone's room for a couple of hours and when I looked through history, I found these commands were most recent (pretty sure it was not me as i recall the previous set):

cd ~/Library
cd Messages/
cd Archive
cd ~

When I repeated the commands I got as far as producing

Attachments chat.db chat.db-shm chat.db-wal

But past that I can't trace or understand what the next command did. Tried to change the history log to show date/time stamps on the history logs but they all just came out as today's date, I guess because I only just applied the format to it now.

I'm not a programmer, know v v little about any of this. Got as far as that ^ through Google. Could someone please explain what those commands most likely did, and whether I'm being paranoid in suspecting that said person has tried to export my messages? The last previous command set (which I was there for) had ended in an archive of my most recent Pages work being sent over to somebody via iMessage - could that have been it? Just a bit weird because there was an "exit" just before this set, so it seems like somethings separate ... + I still can't explain the 00:02 login this morning..... Is there a way to prove the worst, if it is so?

Thank you!

2 Answers 2


You can infer two facts that might be helpful:

First, the login was from ttys000. This means that the login was not via the network, but local. Second, since there is a typo in the commands ("l" instead of "ls") it certainly was a human typing these commands, and not a script.

So the question should be: who has physical access to your computer?


The commands you listed in your question take you into the currently logged in user's Messaging App's message archive, lists the contents of that directory and then goes back to the currently logged in user's home directory. If you were logged in, then it's your messaging archive.

The exit command exits, or closes, the Terminal session, nothing more.

To see who has logged into your computer (or when the last time you logged in from where), type the command last in your Terminal:

$ last

To get a listing of the commands you have executed type:

$ history

If you want to save that to a file for later reading, type this:

$ history > ~/Desktop/history.txt

and a file will show up on your Desktop with all those commands. You can use the same technique for last but be sure to rename the file.

Now, if you want to see what happens when you are not in front of your Mac, just clear out the history before you leave with the command history -c. This way, you will see exactly what has been done when you weren't around.

Now, you obviously have a 2AM login into your computer. Why

a) do you not have a password


b) if you do have one, why is it shared with others?

  • It's my boyfriend. I do have a password, I didn't realise he knew it. Mar 5, 2016 at 12:54
  • I went onto console and saw there were 2 sessions - he's admitted to going through iMessages and photos but there was a second session with some weird activity which I thiiiiink involved AirPort - can't get my head around it, is there a way I can show you the console data for that 10 min session? I presume just copy paste dumping it on here is probably not ideal aha Mar 5, 2016 at 12:56
  • Oh and sorry, and thank you for the fast response Mar 5, 2016 at 12:57
  • I'll update my answer....
    – Allan
    Mar 5, 2016 at 12:59
  • Okay I've uploaded the console log onto txt.do/5vg7v Mar 5, 2016 at 13:04

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .