So when I checked my computer this morning I had Terminal open saying:
Last login: Sat Mar 5 00:02:43 on ttys000
I checked uptime and it's been up 27 days, 2 users as usual.
Now I know for a fact that at that precise time I had left my laptop in someone's room for a couple of hours and when I looked through history, I found these commands were most recent (pretty sure it was not me as i recall the previous set):
cd ~/Library
cd Messages/
l
ls
cd Archive
cd ~
exit
When I repeated the commands I got as far as producing
Attachments chat.db chat.db-shm chat.db-wal
But past that I can't trace or understand what the next command did.
Tried to change the history log to show date/time stamps on the history logs but they all just came out as today's date, I guess because I only just applied the format to it now.
I'm not a programmer, know v v little about any of this. Got as far as that ^ through Google. Could someone please explain what those commands most likely did, and whether I'm being paranoid in suspecting that said person has tried to export my messages? The last previous command set (which I was there for) had ended in an archive of my most recent Pages work being sent over to somebody via iMessage – could that have been it? Just a bit weird because there was an "exit" just before this set, so it seems like somethings separate … + I still can't explain the 00:02 login this morning….. Is there a way to prove the worst, if it is so?
Thank you!
Best Answer
You can infer two facts that might be helpful:
First, the login was from ttys000. This means that the login was not via the network, but local. Second, since there is a typo in the commands ("l" instead of "ls") it certainly was a human typing these commands, and not a script.
So the question should be: who has physical access to your computer?