Could I use the system logs to know if log-ins, log-outs, etc were done in this Mac?…how can I know the user didn’t put the storage into another similar Mac and operated the machine from that mac?

Any books/articles/courses explaining this stuff? (without having to do a degree in digital forensics)


1 Answer 1


You can use the command line tool last to list sessions of specified users.

I cannot find an online manual that Apple hosts so I found the closest thing I could.


For example in the terminal.app you could type

last "name of user" 

That command get a list of logins (among other data for the said user - see above link for specifics) However should be able to get a sense of when the user was on the computer or not. Therefore determining if the user was on a computer at a given time. This won't tell you what files the user transferred or accessed. But, you might be able to narrow that down if you know what machine a give person was on at a given time.


Not the answer you're looking for? Browse other questions tagged .