Hi,
I am auditing a user who has left the company under "odd" circumstances. Where in the logs can I see what has been deleted or removed. I see stuff being copied in the system.log but would like to know if it's Time Capsule (.com.apple.backup) or something/one else. Any other tricks or help to see what users has been up to in the last 24 hours?
Thanks
Tyche
I am auditing a user who has left the company under "odd" circumstances. Where in the logs can I see what has been deleted or removed. I see stuff being copied in the system.log but would like to know if it's Time Capsule (.com.apple.backup) or something/one else. Any other tricks or help to see what users has been up to in the last 24 hours?
Thanks
Tyche