How can I tell if someone copied files off of my G4?

Question

I left my G4 unlocked because itunes was running for the stereo, I walked in to my office on someone acting funny. How can I determine if he copied files off of my Dual G4 onto a usb thumb drive, CD or DVD... Can I simply check an activity log, console or terminal?? All I need to know is if someone did anything which my system other then listen to itunes during a three hour window. Thanks in advance

Answer 1

You need to look at your system log in Console utility.  Open Console in the /Applications/Utilities folder (cmd-shift-U will get you there right away), which will open with the console.log file.  Click the Logs icon to reveal the other log files available, and you should find system.log right under console.log.  Click system.log.
Now, in the filter window in the upper right corner of the window, type diskarbitration to filter.  That will tell you if any thumb drive was connected, at least. This is the kind of thing you should find, maybe.  The time stamp is important.
You may need to go back several swapped system.log versions, to be sure, so you need to then reveal the log files and folders under /var/log by clicking the triangle, then go down that list until you see eight files named system.log.0.gz through system.log.7.gz.  Click each in turn and if they are not very short, filter again on diskarbitration.
Now, if you find something suspicious, you need to preserve the specific log file, as it will be rotated out by the daily maintenance.  Bring up the Go to Folder dialog from Finder by the keyboard shortcut of cmd-shift-G, and type in /var/log as the name of the folder.  This will bring up a folder with the log files of interest, which is normally an invisible folder.  Select the log file you want to protect and duplicate it using cmd-D.  Then move that duplicate to someplace safe.
You may also find CD burn information in the diskrecording.log file as well.
Message was edited by: old comm guy to add the last log file to look for.