Do you suspect that someone else is accessing your MacBook without your permission? This can feel like an invasion of privacy, especially if they’re doing it for all the wrong reasons. Don’t worry—you’re not alone. Many people have these concerns after leaving their MacBook at work or at home.
You could physically dust your Mac for fingerprints, of course, but if you lack the gear for that, there are digital tools you can use for this detective work instead. You’ll be amazed at what you can find out just by checking logs and looking at recently opened documents and applications.
How to Check Who’s Accessed Your Mac Recently
We always advise keeping your Mac secure using a password, which you change from time to time. But even if you do that, there’s still a risk that someone could figure out your password and get access to your computer.
In this case, you can check the Mac login activity and recent logs to search for suspicious activity. This assumes that you left your Mac in sleep mode (and logged out). We’ll show you how to do that using Terminal below.
Check the Login History in Terminal
The quickest way to check your MacBook’s login history is by using the last command in Terminal. This lists all the login events on your Mac in descending order.
To do this, open up Terminal on your Mac. Type in last and press Enter.
This will list all the login events with your account username and the exact login time. You can use this to guess whether someone else may have logged in to your Mac behind your back. It will also include the history of your Mac being restarted or shut down, which might be helpful.
Check the Logs in Terminal
You can also access your system logs using Terminal. Since macOS records everything your Mac does, it’s a very long list of logs. However, you can narrow it down using the following command in Terminal. Just type in the following and press Enter:
log show --style syslog | fgrep "[powerd:sleepWake]"You’ll see a long list of logs. Since most of these are system events, you might find it difficult to filter through them, but you can focus on the timestamp on the specific logs. This should help you figure out the times your Mac was opened or logged in to.
Knowing when your computer wakes up might not be enough—cats pressing keyboard keys can be enough to prompt this. But if you’re using a MacBook you’ll know exactly when someone opened it to use your computer, and that’s very helpful.
This won’t tell you who is using your computer, of course, or what they did. But it’s a good place to start.
Check the Recent Items
Your Mac keeps track of recently opened applications and documents. It does this mainly to help you quickly access them again, but it’s also really useful if you suspect someone else is using your computer. After all, they’ll possibly be interested in different applications and documents than you are.
See a list of all recent applications and documents by clicking the Apple logo in the top-left corner, then hovering over Recent Items. You’ll see a list showing the applications and documents that have recently been used.
Hold Cmd
on the keyboard and click to see these files in Finder, giving you access to information like when they were last opened.
Another method to access the recent items is to open up Finder on your Mac. Click on Go > Recent Folders from the menu bar, and you should see a list of all recently opened files. This includes recently opened documents, pictures, movies, and more. However, it is possible for people to clear this menu using the Clear Menu button, which is why it may not be that reliable.
If you find something here you know you didn’t look at recently, then you’ve got one more piece of evidence that someone else is using your Mac while you’re not around.
There are other “recent” things to check, of course, beyond what your Mac records on its own. Your web browser, for example, includes a detailed web history. You can find this from the Browser History in your browser menu bar, regardless of which one you use. However, you should note that it is quite easy to circumvent history tracking by using a browser’s in-built private browsing method.
Applications like Microsoft Word and InDesign also have their own list of recently opened documents. Check these and other applications if you want to gather further evidence.
Install Snooping Software
If this isn’t telling you enough, and you suspect the unauthorized usage is ongoing, you could install some snooping software to find out what’s going on.
Prey, which offers a free trial or subscription, lets you monitor computer usage from any other device connected to the web. You can take screenshots to see exactly what’s going on with your Mac while you’re away from it. Heck, you could even use it to take a picture of your moocher using the built-in webcam.
Kill It With Passwords
But there’s an even simpler solution: lock your Mac with a password. If you don’t want people using your computer behind your back, this is the most effective means of doing so. If you already have a password, change it and don’t tell anyone the new one.
If you’d rather not do that, however, you should get a pretty good idea of who’s using your Mac with the steps above—between the logs and the recent apps, a decent detective should be able to rule out most major suspects. The rest, of course, is up to you.
Read Next
About The Author
