Do you think that someone logged on your MacBook and copied the files from it? Do you feel that something has changed on your Mac, but you can’t tell why you have such a feeling? If so, I understand your concern because this is one of the most common questions people ask after leaving their MacBooks at home or work.
I always advise to set log in passwords and change them from time to time. But even if you do, there is a risk that someone can crack and still get access to your computer.
Refog Keylogger Mac Crack Software – Heroku. Feb 6, 2013 — Secret online activities are revealed due to Refog Keylogger for Mac. By logging keystrokes, program gives an inside look at their child'. 7 results — Some people would rather look for a refog keylogger mac crack or serial key. Download and install our programs for. Refog Mac Keylogger free download - Free Mac Keylogger, Perfect Keylogger, MacKeylogger, and many more programs. Nov 19, 2019 Download Refog. Submit a request Sign in. Refog Customer Service; What's New in Refog; Refog 3.3 for Mac. Max November 19, 2019 13:24. Refog for Mac version 2.2. Refog-free-keylogger 6.1.6.1040 crack: Krylack Ultimate Keylogger Free Edition 1.80 crack: Free Keylogger Downloads 37 patch: Keylum - Keylogger - Free Culture serials key: World Of Warcraft For Mac Os X - Play Lich King Free On Private Server - Itr Wow 3.2.2 keygen: Winx-avchd-video-converter-for-mac-free-edition.dmg keygen.
In this case, you probably want to check the Mac login history when searching for suspicious activity when you assume that your Mac is in sleep mode.
The easiest way to see the MacBook login history is to use the “last” command. Use Command+space key combination to start Spotlight Search, type Terminal in the search window, and hit Enter. In the Terminal app window type “last” and hit Enter. The command will print all login events in descending order.
Let me explain how to check the last login on Mac with the Terminal. For instance, here is the screenshot from the command I ran on one of my Macs. To make things more interesting, I also connected remotely as a user from my other MacBook.
The first output on the screen is my remote connection. As you can see, I logged on from another computer using Terminal (ttys001) as user1.
A user User1 is a second user I created on my local Mac. You can also see the IP address (192.168.0.102) of the remote Mac from which I logged in to the local computer. Since both Macs are on the same WiFi network, I was able to use ssh to login.
It is possible to disable remote connections to your Mac, check my article on the exact steps involved in disabling sharing preferences.
The second line is from my current user “tester,” and I am still logged in (obviously). The ttys000 just means the first terminal window. If you open another Terminal window, it will be assigned as ttys001. The next will be ttys002, and so on. So, if you see the last login as ttys000, it merely means your current session.
Besides this simple command, there are other ways to see if someone has logged into your Mac and messed with it.
How To See The Recent Activity On Your Mac
Use the Console app to browse the logs
For a long time, macOS had logs spread in multiple places on the disk, and anyone who wanted to find any information was forced to check various logs, usually under varlogs folder. Now, all logs have been consolidated, and there is one app that provides unified access to all of them at once. The app is called Console.
To start it, type Console in Spotlight Search or start LaunchPad and find the app under Other folder.
The best way to search all the logs is to type a part of the string you are looking for in the search bar.
For instance, if I want to know when I (or someone else ) opened the lid on my MacBook, I can type LidOpen. From the screenshot below, I can tell that the last time I opened my laptop at 20:40. And before that, I did the same at 19:32, 18:27, and 18:05. I was probably interrupted too many times that day.
But this was only recent data. To see historical data click on the Mac Analytics Data section on the left. And in the search bar, type “Lid Open” (with space).
And again, I would see the same times and more. For instance, I can see that last time I opened my MacBook the day before at 20:44, and the next time I did it on the next day at 9:18 am.
Use log config command for failed login attempts
Another thing when researching if someone has logged into your Mac is knowing if there were unsuccessful attempts to log in. Getting this information is surprisingly hard, especially for non-technical people.
To see failed login attempts on macOS High Sierra or earlier enable logging private data first. Use sudo log config –mode “private_data:on” command in the Terminal with admin user. After this, the system log will contain information about all login attempts.
However, recently Apple tightened up the security, and the command does not work anymore. Instead it will print “log: Invalid Modes ‘private_data:on'” message. If you really need to enable this, there was an executable developed by this guy. So, do it at your own risk.
Check Recent Folders in Finder
If you suspect that someone is browsing the disk with the Finder (aka explorer on Mac), you should know that the app tracks the recently accessed folder.
To see them, start the Finder from the Dock. In the menu bar, click on Go -> Recent Folders menu. It is possible to clear this list by clicking the Clear Menu item at the bottom of the list. The combination of clearing the menu and checking recent folders can be used to find out if someone was using the Mac without you knowing.
In this case, I would use Clear Menu to start with a clean slate, and then avoid to open the Mac for a couple of days. After some time, open the Finder again and check if Recents Folders have been populated and which folders have been used.
There are also Recent Items under the main Apple menu: click on the Apple logo, and click on Recent Items in the dropdown list. This list contains the last apps that were run and recent documents open.
And the final place to look is the Recents folder in the Finder. Unlike Recent Folders, the Recents folder cannot be cleaned because it’s not a real folder. There are ways to hide files and folders from being tracked here, and I described them all in my previous post.
Check the browser history
Another way to see if someone used a computer is to check browser history. By default, all browsers, including Safari and Google Chrome, save the pages that have been opened.
It is possible that the browser is configured to clear the history on exit. I usually have one browser configured this way to avoid saving sensitive information. Together with VPN, it’s an excellent way to ensure that no one can track your activity.
Refog Free Keylogger
I am not going to post here the steps of checking the browser history. The steps change too often, and they can be easily found on the Internet.
Check Recent Items in apps
Another way to see which files have been opened is to check the apps associated with them. For instance, the default application to start when opening an image, png or jpeg, is the Preview.
To see the list of recently opened images, go to File->Open Recent menu. Again, at the bottom of the list, there is a Clear Menu command, which can be used to clear the Recents list. And then you just watch if someone opens images you are trying to hide.
Other apps to checks are Microsoft Word and Excel, Adobe Acrobat.
Install Keylogger to track activity
Some time ago, I wrote an article about keyloggers and how to find if someone else installed them on your computer.
The thing is that it is possible to have it installed on your own computer (do not install keyloggers on someone else’s Mac, but you can do whatever you want on your computer). And this is a fantastic tool to see if someone was using your Mac without permission. And even get more information.
Here’s how you do it:
1. Download Refog Keylogger for Mac
When I reviewed various keyloggers in my post, Refog was the least spammy option. In fact, they promote their tool as a solution for parents tracking kids’ activity or for employers to monitor their employees.
So, first, go to this page (affiliate) and click Download.
It will ask you to create an account first.
Once the account is created, log in and download the version you need (Personal Monitor for Mac).
Double-click on the DMG file (it would have a random name) to start the installer.
Then proceed with the install wizard. They have a good install doc online.
Additionally, if you have an antivirus, several steps need to be taken to avoid conflicts. Check for detailed instructions here.
Note that you have several days to run the tool in trial mode. When the Refog keylogger in trial mode, it will be in a visible mode: there will be a Refog icon in the top bar. To hide Refog, you need to upgrade to a paid version.
Mac Download Game
2. Configure the Settings
I like to configure some settings before using the keylogger.
In the Screenshots set how often to take them. If you set it to do too often, then you will have too much data. If set to infrequent, then the important information will be missed. It is possible to balance frequency with the quality of the images. Choosing the Grayscale option and lower quality allows more frequent snapshots with the same disk and network usage.
In the Delivery tab, enter the email address if you want to receive notifications via email. For this purpose, I would open a new email account. Do not put your main email here.
3. Analyze the collected data
There are several areas where you can see useful information on the Refog dashboard.
All activity is grouped by users, so if you have multiple users, there will be multiple groups.
Now, you can see the websites anyone on your Mac visited, the text that was typed on the keyboard, periodic screenshots, and when applications started and stopped.
Refog Mac Download Windows 10
Since we are interested in login history, it is available in the Applications tab.
On the screenshot above, you can see that I had two users on my MacBook: Tester and User1. Under the Applications tab, there are several events:
- Log In – is an event when the user logged in by typing the password.
- Screen Lock – when the user locked the screen, e.g., using Command+Control+Q keys.
- Sleep – when the user closed the MacBook lid
- Wake – when the user opened the lid
- Shut Down – when the user logged off the Mac
So, in short, a keylogger (assuming it was installed on your own Mac), is the easiest way to check the recent activity on the computer compared to other DIY options.
What’s Next?
There is so much more hackers or frenemies can do when they get access to your Mac. For instance, they can connect to your MacBook remotely.
This post is a part of the series of articles about Mac security. Use links below to read them all if you concerned with someone hacking your computer.
Photo credit: ©canva.com/Olga Vorobeva