4

I left my laptop around with co-workers for around 30-40 minutes. Can I find out if any files were exported/opened from my laptop during that time?

11/5/17 3:12:09.000 PM syslogd[47]: ASL Sender Statistics
11/5/17 3:13:10.325 PM Microsoft Word[1299]: open on /Users/rakanalami/Library/Group Containers/UBF8T346G9.Office/MicrosoftShipAssertLog_MSWD1299_Send.txt: File exists
11/5/17 3:15:16.302 PM WindowServer[177]: send_datagram_available_ping: pid 420 failed to act on a ping it dequeued before timing out.
11/5/17 3:16:00.429 PM BezelServices 255.10[98]: ASSERTION FAILED: result == 0 -[KeyboardALSAlgorithmLegacy setDriverSuppressed] line: 135
11/5/17 3:16:00.436 PM com.apple.usbmuxd[84]: notice    failed to get the v3 runloopsource
11/5/17 3:16:00.438 PM AirPlayUIAgent[288]: 2017-11-05 03:16:00.437362 PM [AirPlayUIAgent] BecomingInactive: NSWorkspaceWillSleepNotification
11/5/17 3:16:00.444 PM CommCenter[236]: Telling CSI to go low power.
11/5/17 3:16:00.000 PM kernel[0]: Setting BTCoex Config: enable_2G:1, profile_2g:0, enable_5G:1, profile_5G:0
11/5/17 3:16:00.000 PM kernel[0]: AppleCamIn::systemWakeCall - messageType = 0xE0000340
11/5/17 3:16:00.529 PM sharingd[250]: 15:16:00.529 : BTLE scanner Powered Off
11/5/17 3:16:00.531 PM sharingd[250]: 15:16:00.530 : BTLE scanner Powered Off
11/5/17 3:16:00.559 PM identityservicesd[255]: <IMMacNotificationCenterManager: 0x7f83bac3ed60>: notification observer: com.apple.iChat   notification: __CFNotification 0x7f83bae4e5f0 {name = _NSDoNotDisturbEnabledNotification}
11/5/17 3:16:00.560 PM imagent[289]: <IMMacNotificationCenterManager: 0x7fed3971bae0>: notification observer: com.apple.FaceTime   notification: __CFNotification 0x7fed39716020 {name = _NSDoNotDisturbEnabledNotification}
11/5/17 3:16:00.573 PM identityservicesd[255]: <IMMacNotificationCenterManager: 0x7f83bac3ed60>:    NC Disabled: NO
11/5/17 3:16:00.573 PM sharingd[250]: 15:16:00.572 : Purged contact hashes
11/5/17 3:16:00.573 PM sharingd[250]: 15:16:00.573 : Discoverable mode changed to Off
11/5/17 3:16:00.573 PM sharingd[250]: 15:16:00.573 : BTLE scanning stopped
11/5/17 3:16:00.588 PM identityservicesd[255]: <IMMacNotificationCenterManager: 0x7f83bac3ed60>:   DND Enabled: YES
11/5/17 3:16:00.589 PM identityservicesd[255]: <IMMacNotificationCenterManager: 0x7f83bac3ed60>: Updating enabled: NO   (Topics: (
))
11/5/17 3:16:00.589 PM imagent[289]: <IMMacNotificationCenterManager: 0x7fed3971bae0>:    NC Disabled: NO
11/5/17 3:16:00.589 PM identityservicesd[255]: <IMMacNotificationCenterManager: 0x7f83bae6eb70>: notification observer: com.apple.iChat   notification: __CFNotification 0x7f83bac619c0 {name = _NSDoNotDisturbEnabledNotification}
11/5/17 3:16:00.600 PM imagent[289]: <IMMacNotificationCenterManager: 0x7fed3971bae0>:   DND Enabled: YES
11/5/17 3:16:00.600 PM imagent[289]: <IMMacNotificationCenterManager: 0x7fed3971bae0>: Updating enabled: NO   (Topics: (
))
11/5/17 3:16:00.600 PM identityservicesd[255]: <IMMacNotificationCenterManager: 0x7f83bae6eb70>:    NC Disabled: NO
11/5/17 3:16:00.606 PM identityservicesd[255]: <IMMacNotificationCenterManager: 0x7f83bae6eb70>:   DND Enabled: YES
11/5/17 3:16:00.606 PM identityservicesd[255]: <IMMacNotificationCenterManager: 0x7f83bae6eb70>: Updating enabled: NO   (Topics: (
))
11/5/17 3:16:01.000 PM kernel[0]: AppleCamIn::systemWakeCall - messageType = 0xE0000340
11/5/17 3:16:01.429 PM WindowServer[177]: send_datagram_available_ping: pid 420 failed to act on a ping it dequeued before timing out.
11/5/17 3:16:01.595 PM WindowServer[177]: device_generate_desktop_screenshot: authw 0x7fcd03b74800(2000), shield 0x7fcd031ae400(2001)
11/5/17 3:16:01.595 PM WindowServer[177]: device_generate_lock_screen_screenshot: authw 0x7fcd03b74800(2000)[0, 0, 0, 0] shield 0x7fcd031ae400(2001), dev [1440,900]
11/5/17 3:16:01.785 PM WindowServer[177]: no sleep images for WillPowerOffWithImages
11/5/17 3:16:01.906 PM com.apple.xpc.launchd[1]: (com.apple.xpc.launchd.domain.user.501) Service "com.apple.xpc.launchd.unmanaged.loginwindow.98" tried to hijack endpoint "com.apple.tsm.uiserver" from owner: com.apple.SystemUIServer.agent
11/5/17 3:16:01.907 PM com.apple.xpc.launchd[1]: (com.apple.xpc.launchd.domain.user.501) Service "com.apple.xpc.launchd.unmanaged.loginwindow.98" tried to hijack endpoint "com.apple.tsm.uiserver" from owner: com.apple.SystemUIServer.agent
11/5/17 3:16:11.800 PM loginwindow[98]: CoreAnimation: warning, deleted thread with uncommitted CATransaction; set CA_DEBUG_TRANSACTIONS=1 in environment to log backtraces.
11/5/17 3:16:15.000 PM kernel[0]: AirPort: Link Down on en0. Reason 8 (Disassociated because station leaving).
11/5/17 3:16:15.000 PM kernel[0]: en0: channel changed to 1
11/5/17 3:16:15.000 PM kernel[0]: en0::IO80211Interface::postMessage bssid changed
11/5/17 3:16:15.655 PM symptomsd[256]: -[NetworkAnalyticsEngine _writeJournalRecord:fromCellFingerprint:key:atLOI:ofKind:lqm:isFaulty:] Hashing of the primary key failed. Dropping the journal record.
11/5/17 3:16:15.000 PM kernel[0]: Setting BTCoex Config: enable_2G:1, profile_2g:0, enable_5G:1, profile_5G:0
11/5/17 3:16:16.743 PM ntpd[196]: sigio_handler: sigio_handler_active != 1
11/5/17 3:16:16.743 PM ntpd[196]: sigio_handler: sigio_handler_active != 0
11/5/17 3:16:18.000 PM kernel[0]: PM response took 3119 ms (56, powerd)
11/5/17 3:16:18.000 PM kernel[0]: kern_open_file_for_direct_io(28)
11/5/17 3:16:18.000 PM kernel[0]: kern_open_file_for_direct_io took 0 ms
11/5/17 3:16:18.000 PM kernel[0]: error 0xe00002db opening polled file
11/5/17 3:16:18.000 PM kernel[0]: AppleCamIn::systemWakeCall - messageType = 0xE0000280
11/5/17 3:16:18.000 PM kernel[0]: ARPT: 15988.048948: AirPort_Brcm43xx::powerChange: System Sleep 
11/5/17 3:16:18.000 PM kernel[0]: ARPT: 15988.049000: IOPMPowerSource Information: onSleep,  SleepType: Deep Idle,  'ExternalConnected': No, 'TimeRemaining': 312, 
11/5/17 3:16:18.000 PM kernel[0]: ARPT: 15988.049020: wl0: powerChange: *** BONJOUR/MDNS OFFLOADS ARE NOT RUNNING.
11/5/17 3:16:18.000 PM kernel[0]: AppleCamIn::systemWakeCall - messageType = 0xE0000340
11/5/17 3:49:54.000 PM kernel[0]: en0: channel changed to 1
11/5/17 3:49:54.000 PM kernel[0]: AppleThunderboltNHIType2::prePCIWake - power up complete - took 1659 us
11/5/17 3:49:54.000 PM kernel[0]: AirPort: Link Down on awdl0. Reason 1 (Unspecified).
11/5/17 3:49:54.000 PM kernel[0]: ARPT: 15988.634907: wl0: leaveModulePoweredForOffloads: Wi-Fi will turn off.
11/5/17 3:49:54.000 PM kernel[0]: AppleThunderboltGenericHAL::earlyWake - complete - took 0 milliseconds
11/5/17 3:49:54.000 PM kernel[0]: Bluetooth -- LE is supported - Disable LE meta event
11/5/17 3:49:54.000 PM kernel[0]: ARPT: 15988.650861: AirPort_Brcm43xx::syncPowerState: WWEN[disabled]
11/5/17 3:49:54.000 PM kernel[0]: IOThunderboltSwitch<0>(0x0)::listenerCallback - Thunderbolt HPD packet for route = 0x0 port = 11 unplug = 0
11/5/17 3:49:54.000 PM kernel[0]: AppleCamIn::systemWakeCall - messageType = 0xE0000340
11/5/17 3:16:20.000 PM kernel[0]: AppleThunderboltNHIType2::waitForOk2Go2Sx - retries = 2
11/5/17 3:49:54.000 PM kernel[0]: Wake reason: EC.LidOpen (User)
11/5/17 3:49:54.000 PM kernel[0]: AppleCamIn::systemWakeCall - messageType = 0xE0000320
11/5/17 3:49:54.000 PM kernel[0]: AppleCamIn::systemWakeCall - messageType = 0xE0000340
11/5/17 3:49:54.000 PM kernel[0]: AppleCamIn::wakeEventHandlerThread
11/5/17 3:49:54.000 PM kernel[0]: Previous sleep cause: 5
11/5/17 3:49:54.000 PM kernel[0]: AppleIntelLpssSpiController1::_reset: fDmacService is NULL
11/5/17 3:49:54.000 PM syslogd[47]: ASL Sender Statistics
11/5/17 3:49:54.007 PM CommCenter[236]: Telling CSI to exit low power.
11/5/17 3:49:54.000 PM kernel[0]: AppleHSSPIController::HandleMessage Device Wake by Host
11/5/17 3:49:54.033 PM WindowServer[177]: send_datagram_available_ping: pid 420 failed to act on a ping it dequeued before timing out.
11/5/17 3:49:54.000 PM kernel[0]: in6_unlink_ifa: IPv6 address 0xf0fcb63b09384893 has no prefix
11/5/17 3:49:54.046 PM ntpd[196]: sigio_handler: sigio_handler_active != 1
11/5/17 3:49:54.046 PM ntpd[196]: sigio_handler: sigio_handler_active != 0
11/5/17 3:49:54.046 PM ntpd[196]: sigio_handler: sigio_handler_active != 1
11/5/17 3:49:54.046 PM ntpd[196]: sigio_handler: sigio_handler_active != 0

Hello, I have now found more logs, can anyone tell me if a usb was used to extract files in these logs

11/5/17 1:02:24.000 PM kernel[0]: AirPort: Link Down on awdl0. Reason 1 (Unspecified).
11/5/17 1:02:24.000 PM kernel[0]: ARPT: 15118.298447: wl0: leaveModulePoweredForOffloads: Wi-Fi will turn off.
11/5/17 1:02:24.000 PM kernel[0]: AppleThunderboltNHIType2::prePCIWake - power up complete - took 1670 us
11/5/17 1:02:24.000 PM kernel[0]: AppleThunderboltGenericHAL::earlyWake - complete - took 0 milliseconds
11/5/17 1:02:24.000 PM kernel[0]: Bluetooth -- LE is supported - Disable LE meta event
11/5/17 1:02:24.000 PM kernel[0]: ARPT: 15118.316263: AirPort_Brcm43xx::syncPowerState: WWEN[disabled]
11/5/17 1:02:24.000 PM kernel[0]: IOThunderboltSwitch<0>(0x0)::listenerCallback - Thunderbolt HPD packet for route = 0x0 port = 11 unplug = 0
11/5/17 1:02:24.000 PM kernel[0]: IOThunderboltSwitch<0>(0x0)::listenerCallback - Thunderbolt HPD packet for route = 0x0 port = 12 unplug = 0
11/5/17 1:02:24.000 PM kernel[0]: AppleCamIn::systemWakeCall - messageType = 0xE0000340
11/5/17 10:02:23.000 AM kernel[0]: AppleThunderboltNHIType2::waitForOk2Go2Sx - retries = 2
11/5/17 1:02:24.000 PM kernel[0]: Wake reason: EC.SleepTimer (SleepTimer)
11/5/17 1:02:24.000 PM kernel[0]: AppleCamIn::systemWakeCall - messageType = 0xE0000340
11/5/17 1:02:24.000 PM kernel[0]: AppleCamIn::wakeEventHandlerThread
11/5/17 1:02:24.000 PM kernel[0]: Previous sleep cause: 5
11/5/17 1:02:24.000 PM kernel[0]: AppleIntelLpssSpiController1::_reset: fDmacService is NULL
11/5/17 1:02:24.000 PM syslogd[47]: ASL Sender Statistics
11/5/17 1:02:24.000 PM kernel[0]: AppleHSSPIController::HandleMessage Device Wake by Host
11/5/17 1:02:24.000 PM kernel[0]: in6_unlink_ifa: IPv6 address 0xf0fcb63b09384893 has no prefix
11/5/17 1:02:24.030 PM ntpd[196]: sigio_handler: sigio_handler_active != 1
11/5/17 1:02:24.030 PM ntpd[196]: sigio_handler: sigio_handler_active != 0
11/5/17 1:02:24.000 PM kernel[0]: AppleThunderboltNHIType2::prePCIWake - power up complete - took 180137 us
11/5/17 1:02:24.000 PM kernel[0]: AppleThunderboltGenericHAL::earlyWake - complete - took 1 milliseconds
11/5/17 1:02:24.248 PM hidd[102]: [HID] [MT] MTSimpleHIDManager::deviceDidBootload device bootloaded
11/5/17 1:02:24.000 PM kernel[0]: IOThunderboltSwitch<0>(0x0)::listenerCallback - Thunderbolt HPD packet for route = 0x0 port = 11 unplug = 0
11/5/17 1:02:24.000 PM kernel[0]: IOThunderboltSwitch<0>(0x0)::listenerCallback - Thunderbolt HPD packet for route = 0x0 port = 12 unplug = 0
11/5/17 1:02:24.000 PM kernel[0]: TBT W (2): 0x0100 [x]
11/5/17 1:02:24.000 PM kernel[0]: en0: channel changed to 1
11/5/17 1:02:24.000 PM kernel[0]: AirPort: Link Up on awdl0
11/5/17 1:02:24.000 PM kernel[0]: ARPT: 15120.490079: AirPort_Brcm43xx::powerChange: System Wake - Full Wake/ Dark Wake / Maintenance wake
11/5/17 1:02:24.000 PM kernel[0]: ARPT: 15120.490134: IOPMPowerSource Information: onWake,  SleepType: Deep Idle,  'ExternalConnected': No, 'TimeRemaining': 17276, 
11/5/17 1:02:24.000 PM kernel[0]: ARPT: 15120.490266: AirPort_Brcm43xx::platformWoWEnable: WWEN[disable]
11/5/17 1:02:24.000 PM kernel[0]: AppleCamIn::systemWakeCall - messageType = 0xE0000340
11/5/17 1:02:24.000 PM kernel[0]: AppleCamIn::wakeEventHandlerThread
11/5/17 1:02:24.000 PM kernel[0]: in6_unlink_ifa: IPv6 address 0xf0fcb63b093840b3 has no prefix
11/5/17 1:02:24.632 PM UserEventAgent[46]: Captive: CNPluginHandler en0: Inactive
11/5/17 1:02:24.637 PM configd[55]: network changed: v4(en0-:172.20.10.3) DNS- Proxy-
11/5/17 1:02:24.637 PM Dock[240]: -[UABestAppSuggestionManager notifyBestAppChanged:type:options:bundleIdentifier:activityType:dynamicIdentifier:when:confidence:deviceName:deviceIdentifier:deviceType:] (null) UASuggestedActionType=0 (null)/(null) opts=(null) when=2017-11-05 11:02:24 +0000 confidence=1 from=(null)/(null) (UABestAppSuggestionManager.m #319)
11/5/17 1:02:24.000 PM kernel[0]: PM response took 153 ms (56, powerd)
11/5/17 1:02:24.802 PM cdpd[539]: Saw change in network reachability (isReachable=0)
11/5/17 1:02:24.804 PM netbiosd[1945]: network_reachability_changed : network is not reachable, netbiosd is shutting down
11/5/17 1:02:24.809 PM symptomsd[256]: __73-[NetworkAnalyticsEngine observeValueForKeyPath:ofObject:change:context:]_block_invoke unexpected switch value 2
11/5/17 1:02:24.881 PM SubmitDiagInfo[2158]: Triggering diganostics messages cleanup
11/5/17 1:02:25.024 PM networkd[184]: nw_path_query_lqm Tried to query LQM on path with no interfaces
11/5/17 1:02:25.025 PM networkd[184]: nw_path_query_lqm Tried to query LQM on path with no interfaces
11/5/17 1:02:25.026 PM networkd[184]: nw_path_query_lqm Tried to query LQM on path with no interfaces
11/5/17 1:02:25.027 PM networkd[184]: nw_path_query_lqm Tried to query LQM on path with no interfaces
11/5/17 1:02:25.027 PM networkd[184]: nw_path_query_lqm Tried to query LQM on path with no interfaces
11/5/17 1:02:25.030 PM networkd[184]: nw_path_query_lqm Tried to query LQM on path with no interfaces
11/5/17 1:02:25.030 PM networkd[184]: nw_path_query_lqm Tried to query LQM on path with no interfaces
11/5/17 1:02:25.030 PM networkd[184]: nw_path_query_lqm Tried to query LQM on path with no interfaces
11/5/17 1:02:25.038 PM networkd[184]: -[NETClientConnection effectiveBundleID] using process name apsd as bundle ID (this is expected for daemons without bundle ID
11/5/17 1:02:25.043 PM networkd[184]: -[NETClientConnection effectiveBundleID] using process name apsd as bundle ID (this is expected for daemons without bundle ID
11/5/17 1:02:25.046 PM networkd[184]: -[NETClientConnection effectiveBundleID] using process name apsd as bundle ID (this is expected for daemons without bundle ID
11/5/17 1:02:25.050 PM networkd[184]: -[NETClientConnection effectiveBundleID] using process name apsd as bundle ID (this is expected for daemons without bundle ID
11/5/17 1:02:25.000 PM kernel[0]: USBMSC Identifier (non-unique): 000000000820 0x5ac 0x8406 0x820, 3
11/5/17 1:02:26.000 PM kernel[0]: PM response took 1374 ms (56, powerd)
11/5/17 1:02:26.000 PM kernel[0]: ARPT: 15122.096547: AirPort_Brcm43xx::powerChange: System Sleep 
11/5/17 1:02:26.000 PM kernel[0]: ARPT: 15122.096595: IOPMPowerSource Information: onSleep,  SleepType: Standby,  'ExternalConnected': No, 'TimeRemaining': 17276, 
11/5/17 1:02:26.000 PM kernel[0]: ARPT: 15122.096612: wl0: powerChange: *** BONJOUR/MDNS OFFLOADS ARE NOT RUNNING.
11/5/17 1:02:26.000 PM kernel[0]: AppleCamIn::systemWakeCall - messageType = 0xE0000340
Improve this question
13
  • You MB fell asleep at 3.16pm and woke up again at 3.49pm, so I doubt anything was "exported" in this time period.
    – klanomath
    Commented Nov 7, 2017 at 8:58
  • And even if there was it won‘t show up in the logs usually
    – nohillside ♦
    Commented Nov 7, 2017 at 9:06
  • Where would it show?
    – Rakan Alami
    Commented Nov 7, 2017 at 9:41
  • So, are you asking hypothetically where it would show if there had been files exported? Because the point that klanomath and patrix are basically making is that nothing was exported during the 33 minutes and 36 seconds your Mac was asleep.
    – Monomeeth ♦
    Commented Nov 7, 2017 at 9:50
  • 1
    I can think of several ways I could use to copy files from your system without leaving any trace at all. So if you are concerned about data privacy, take the whole story as a wakeup call, set a good password with a short timeout, password protect the screensaver, enable FileVault etc.
    – nohillside ♦
    Commented Nov 7, 2017 at 21:30

1 Answer 1

Reset to default
3

You can't, retroactively.

However, you can turn this feature on to audit future events.

Important Note: This answer is to show that this type of auditing can be done and in no way is a guide or a HOWTO for setting up or administering OpenBSM* on macOS. Configuring and managing OpenBSM is considerably outside the scope of an answer here on Ask Different.

By default, the OpenBSM auditing tool is set for only authentication events like login and logout.

Looking at the config file /etc/security/audit/audit_control we see the following:

#
# $P4: //depot/projects/trustedbsd/openbsm/etc/audit_control#8 $
#
dir:/var/audit
flags:lo,aa                  <----------- What gets audited.
minfree:5
naflags:lo,aa
policy:cnt,argv
filesz:2M
expire-after:10M
superuser-set-sflags-mask:has_authenticated,has_console_access
superuser-clear-sflags-mask:has_authenticated,has_console_access
member-set-sflags-mask:
member-clear-sflags-mask:has_authenticated

There are a number of configuration directives that can be found on the FreeBSD BSM Audit Config section of the FreeBSD Handbook.

Additionally, OpenBSM is not configured for every user. Looking at /etc/security/audit_user we find only root is configured:

#
# $P4: //depot/projects/trustedbsd/openbsm/etc/audit_user#3 $
#
root:lo:no

To see if we can audit when a file gets read, modify audit_control so that it has the value flags:lo,aa,fr for "login/logout", "authentication/authorization", and "file read"

Then add a user to audit in the audit_user file with the events we want to see (login and file read):

allan:lo:fr

Restart the service:

sudo audit -i

On one Terminal session, to view the real-time audit log being created, issue command

praudit -l /dev/auditpipe | grep test

to see if it will generate an event for when I read from a "test" file.

On a separate Terminal window:

$ touch test    #creates the file
$ cat test      #reads the file

Back on the first Terminal window we get a response:

sudo praudit -l /dev/auditpipe | grep test
Password:
header,140,11,open(2) - read,0,Tue Nov  7 19:44:45 2017, + 678 msec,argument,2,0x0,flags,path,test,path,/Users/allan/test,attribute,100644,allan,staff,16777218,724870,0,subject,allan,allan,staff,allan,staff,1277,100007,50331650,0.0.0.0,return,success,3,trailer,140,

There's the log entry.

Obviously watching a "pipe" would be counter productive and is only good for test and demos (such as this example). The log files are stored in the /var/audit directory and you can view them with the praudit command

sudo praudit -l /var/audit/XXXXXXXXXXXXX.XXXXXXXXXXXXXX

* OpenBSM is an open source implementation of Sun's Basic Security Module (BSM) Audit API and file format. OpenBSM is derived from the BSM audit implementation found in Apple's open source Darwin operating system, which upon request, Apple relicensed under a BSD licence to allow for integration into FreeBSD and other systems. The Darwin BSM implementation was created by McAfee Research under contract to Apple, and has since been extensively extended by the volunteer TrustedBSD team. OpenBSM is included in FreeBSD as of version 6.2 and later, and has been announced as a Mac OS X Snow Leopard feature.

Improve this answer
1
  • Really useful set of hints. Two comments from my experiments: 1a) the flags field specifies what gets audited for all users so you don't need to modify audit_user which specifies additional audits (by default for root). 2) I found sudo audit -I not sufficient. I needed to reboot after any audit_control changes.
    – Gilby
    Commented Sep 12, 2021 at 3:29

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .