How to tell if someone used your Mac

[johnywalker1989]

Hello, 2 questions:

1. Anyone knows what that means? And how I can find what file is the objct 4348?

Dec 29 13:33:55 user quicklookd[4348]: objc[4348]: Class SFUZipArchiveMemoryDataRepresentation is implemented in both /System/Library/PrivateFrameworks/OfficeImport.framework/Versions/A/OfficeImport and /Library/QuickLook/iWork.qlgenerator/Contents/MacOS/iWork. One of the two will be used. Which one is undefined.
Dec 29 13:33:55 user quicklookd[4348]: objc[4348]: Class SFUZipArchiveOutputStream is implemented in both /System/Library/PrivateFrameworks/OfficeImport.framework/Versions/A/OfficeImport and /Library/QuickLook/iWork.qlgenerator/Contents/MacOS/iWork. One of the two will be used. Which one is undefined.
Dec 29 13:33:55 user quicklookd[4348]: objc[4348]: Class SFUZipOutputEntry is implemented in both /System/Library/PrivateFrameworks/OfficeImport.framework/Versions/A/OfficeImport and /Library/QuickLook/iWork.qlgenerator/Contents/MacOS/iWork. One of the two will be used. Which one is undefined.
Dec 29 13:33:55 user quicklookd[4348]: objc[4348]: Class SFUZipFreeSpaceEntry is implemented in both /System/Library/PrivateFrameworks/OfficeImport.framework/Versions/A/OfficeImport and /Library/QuickLook/iWork.qlgenerator/Contents/MacOS/iWork. One of the two will be used. Which one is undefined.

2. Is there anyway to tell if someone used your Mac? I know the method where you check when the lid was opened. But if the lid was open and the mac was not locked how I can check all the activity that happened on my Mac during that time?

 

[maflynn]

If you're concerned about physical access, lock the computer with a password and/or change it to something that they'll not be able to guess.

 

[johnywalker1989]

Yeah I know about that. However I would like to know if someone knows answers to the Q's

 

[Ccrew]

Yeah I know about that. However I would like to know if someone knows answers to the Q's

That's just the PID (Process ID) being logged on something iWork is doing, not going to derive any info on who or what from that

 

[tigerintank]

i'd go to the console app, system log queries, all messages and look at the time period in question - you might see some entries that confirm your suspicions

 

[scaredpoet]

The log errors are all referring to Quick Look, the file preview feature in OS X. If you click once on a file in the finder and hit the space bar, like a photo or a word document, or PDF, a preview will pop up without you having to launch the app. That's Quick Look doing its job.

The error messages suggest some sort of ambiguity in the code, caused by two different types of file types using the same programming class to draw previews of documents. It looks like the two types are iWork documents and MS Office documents, which actually kinda makes sense, considering iWork and MS Office are intended for much of the same purposes and open similar document types.

This could be a low level, hardly-noticed bug in the code. It could be getting tripped by a background process, completely normal. OR, it could be tripped by someone trying to preview a file... you or something else. There's just not enough information from these error messages to prove (or disprove) that someone else was using your computer.

More likely than not though, it's probably nothing to worry about.

As to your second question: without password-locking the Mac, or closing the lid, and without some sort of overt logging software installed, you'd have to look through the logs and see if any activity was triggered that would have to be caused by a user overtly running tasks, as opposed to routine background activity. Easier said than done if you don't know what you're doing or aren't well-versed in reading the logs.

 

[mikecwest]

Hello, 2 questions:

1. Anyone knows what that means? And how I can find what file is the objct 4348?

Dec 29 13:33:55 user quicklookd[4348]: objc[4348]: Class SFUZipArchiveMemoryDataRepresentation is implemented in both /System/Library/PrivateFrameworks/OfficeImport.framework/Versions/A/OfficeImport and /Library/QuickLook/iWork.qlgenerator/Contents/MacOS/iWork. One of the two will be used. Which one is undefined.
Dec 29 13:33:55 user quicklookd[4348]: objc[4348]: Class SFUZipArchiveOutputStream is implemented in both /System/Library/PrivateFrameworks/OfficeImport.framework/Versions/A/OfficeImport and /Library/QuickLook/iWork.qlgenerator/Contents/MacOS/iWork. One of the two will be used. Which one is undefined.
Dec 29 13:33:55 user quicklookd[4348]: objc[4348]: Class SFUZipOutputEntry is implemented in both /System/Library/PrivateFrameworks/OfficeImport.framework/Versions/A/OfficeImport and /Library/QuickLook/iWork.qlgenerator/Contents/MacOS/iWork. One of the two will be used. Which one is undefined.
Dec 29 13:33:55 user quicklookd[4348]: objc[4348]: Class SFUZipFreeSpaceEntry is implemented in both /System/Library/PrivateFrameworks/OfficeImport.framework/Versions/A/OfficeImport and /Library/QuickLook/iWork.qlgenerator/Contents/MacOS/iWork. One of the two will be used. Which one is undefined.

2. Is there anyway to tell if someone used your Mac? I know the method where you check when the lid was opened. But if the lid was open and the mac was not locked how I can check all the activity that happened on my Mac during that time?

The answer above that explains what is happening is a good explanation.

I would like to point out to you, which seems to be your concern. This is NO WAY means that somebody has used your Mac...It does not, however, mean that somebody, did NOT use it either.

The exception to that, is unless you think that somebody else installed MS Office or iWork onto your Mac. Having applications mysteriously appear would indicate that somebody used it.

The explanation above about using a lock code as well, could be helpful, although is not 100% secure by any means.