Did someone copy files from my Mac?

Question

I was away from my MacBook Air (Yosemite) briefly and suspected that someone had copied files from my Mac. Here is what I can see from the system.log under console /var/log. Could some experts advise whether this "(non-unique): 000000000820 " log may be sign that some one plugged in an USB drive? What do I need to search for to find out what directory of files were possibly stolen?

_____________________BEGIN______________________

Mar 31 21:18:41 This mac kernel[0]: USBMSC Identifier (non-unique): 000000000820 0x5ac 0x8406 0x820, 3
Mar 31 21:18:41 This mac kernel[0]: en0: channel changed to 1
Mar 31 21:18:41 This mac.local FinderSyncAPIExtension[1051]: Pipe path is a symbolic link, connecting to target.
Mar 31 21:18:41 This mac kernel[0]: IOBluetoothUSBDFU::probe
Mar 31 21:18:41 This mac kernel[0]: IOBluetoothUSBDFU::probe ProductID - 0x828F FirmwareVersion - 0x0103
Mar 31 21:18:41 This mac kernel[0]: **** [IOBluetoothHostControllerUSBTransport][start] -- completed -- result = TRUE -- 0xb000 ****
Mar 31 21:18:41 This mac kernel[0]: **** [BroadcomBluetoothHostControllerUSBTransport][start] -- Completed (matched on Device) -- 0xb000 ****
Mar 31 21:27:27 This mac kernel[0]: USB (XHCI Root Hub USB 2.0 Simulation):Port 12 on bus 0xa connected or disconnected: portSC(0xe4202a0)
Mar 31 21:27:27 This mac kernel[0]: The USB device Card Reader (Port 3 of Hub at 0x15000000) may have caused a wake by being disconnected

Answer 1

Here's the command for generating a list of all files accessed in the last 72 hours:

sudo find / -atime -72h -ls > output.txt

From there, you can run 'stat' on each file to get the access time.

cat output.txt | while read in; do stat; done > accessTimes.txt

You can narrow your search to a specific date/time range via a text editor or grep command.

grep "Mar 31 21:" accessTimes.txt

This may not be sufficient to prove any wrongdoing, but it can disprove it if there were no files accessed during the window of concern. Also, gives an idea of what was possibly accessed.

Answer 2

The other post, stating that it is impossible to know what this device is, is incorrect.

The line you indicate "USBMSC Identifier (non-unique): 000000000820 0x5ac 0x8406 0x820, 3" actually tells you exactly what kind of device it is:

The number 0x5ac is a Vendor ID that tells you that the device was made by Apple Inc.

The number 0x8406 is a Product ID that tells you that the device is the built-in SDXC card reader in the laptop.

The number 0x820 is the serial number, which is always this number for all the Apple SDXC card readers.

The number 3 is the revision number meaning that this card reader is a revision 3.00.

This means that the device that connected is the internal SDXC card reader inside the laptop. Normally this device is always connected, but it can become disconnected due to for example putting the laptop to sleep.

This tells you that no-one plugged in an external USB drive to your laptop. Instead the internal SDXC card reader simply communicated with the host processor, which it does all the time.

Answer 3

From that log, all you can tell is a USB device was connected or disconnected. It could a USB drive, but then again, that drive could be going to sleep. Someone could have plugged in an iPhone to charge it. The point is, it's impossible to know.

Even if a USB drive was plugged in, there's no way to tell if files were copied from your machine. To see if files were, in fact, copied from (or to) your machine, you need an audit log. Apple comes with one but it's disabled by default.

See this post on OpenBSM.