4

I am acutely aware I may be overly paranoid here.

I left my laptop unattended by myself (I trusted a friend who was beside it). He assures me it was not touched. When I returned I was still logged in. When the network went down shortly later I was clicking through my connections and found my ethernet connection (which I never use, and was unplugged before and after) had last been in use 40 minutes earlier (while I left it unattended). This ethernet port "unfolds" from the laptop and was unfolded (could have been when I took it out of my bag) which is unusual, I did not consciously open it. At that point the network was stable (and is wifi), I took a look in the auth logs but have no idea how to get time stamps or even where I could look to see if something was used. At least I am sure no sudo attempts were made/failed.

Should I be worried/go and speak to security? There is video surveillance there which is my next stop when I am more certain.

Any advice would be appreciated.

Tink
  • 41

1 Answers1

7

The stat command will show you the latest time a file was accessed. The find command can tell you which files were accessed in a certain time span. For instance:

find ~ -amin -210 -amin +60

will list all files under your $HOME that have been accessed between 60 and 210 minutes ago. Use -cmin to locate files which have been modified. That should get you started. However you may be better off concentrating on your coursework.

zwets
  • 12,770
  • 2
  • 37
  • 46