Friday, August 23, 2013

How to Find Out if Someone's Secretly Been Using Your Computer

How to Find Out if Someone's Secretly Been Using Your Computer

If you have a snoopy roommate or a curious sibling, this trick will help you find out if they've been using your computer when you're not around.
While you could always set a password or install something like Prey ahead of time, you might be in a position where you suspect someone's already used your computer without your permission. Checking your computer's built-in logs is a great way to do that after the fact. While it won't give you a ton of information like Prey would, it can at least confirm your suspicions about whether someone's been using your machine. Here's how to do it on Windows and OS X.

How to Check the Windows Event Viewer

How to Find Out if Someone's Secretly Been Using Your ComputerExpand
Windows users just need to open up a program called the Event Viewer, which logs a ton of different things that your computer's recently done. In order to find out when it last awoke:
  1. Head to the Start menu and type "Event Viewer" in the search box. Hit Enter when its option comes up in the menu.
  2. Double click on Windows Logs in the left sidebar, then click on System.
  3. Right click on System and choose Filter Current Log.
  4. In the window that pops up, look for the Event Sources drop down. Choose Power-Troubleshooter from this dropdown and hit OK.
  5. Look at the middle pane of the Event Viewer window. At the top, you should see all the applicable recent events, in descending order of time. Find the time you suspect your computer was used, and see if there are any events. If there are, you can click on them to see more details, like what woke up your computer, in the bottom middle pane.
You'll need to have a general idea of what time the snooper did their business, but if it was recent, it should be pretty easy to find in the logs. If you find that it was used while you were away, you can then check out your Recent Documents, browser history, and other such locations to see if the snooper left any tracks behind. Of course, the next step would be to install an anti-theft program, in hopes that they try again and you can catch them in the act.

How to Check the Mac OS X Console

How to Find Out if Someone's Secretly Been Using Your Computer
If you're using a MacBook, Redditor Moosehadley shares a tip (which inspired this post) to find out when it was last opened. Here's what you need to do:
  1. Click on the Spotlight icon and search for Console. Open up the Console app when you see it in the menu.
  2. Click on kernel.log in the left sidebar. If you don't see the sidebar, click on "Show Log List" and expand /private/var/log first.
  3. Head up to the search bar and search for "Wake reason: EC.LidOpen" (no quotes).
  4. You should now see a list of every time your MacBook was opened and awakened, listed by time. The logs should go back about two weeks according to Moosehadley, so just scroll to the time where you think it might have been opened and see if your suspicions are correct.
Like the Windows method, this requires that you have a general idea of when you yourself have used your computer, since the log won't tell you who woke it up each time. But, if you find that your computer was awakened when you weren't nearby, you know you've got a snooper, and you can then check your browser history, recent apps, or recent documents to see what they might have done. If not, an anti-theft app like Prey will help you catch them if they try again later.
It isn't the simplest or most informative way of catching snoopers, but unlike other solutions, it works even if you didn't have any anti-theft software installed beforehand—so you can catch them after they've already used your machine. If you've got any other tips for finding out who's used your computer (or what they've done on it), be sure to share them in the comments below.
Image remixed from an original by CREATISTA .

No comments:

Post a Comment