1

Is it possible to see or figured if someone accessed my USB or copied any file from it while I was not at home?

3
  • It isn't a complete answer, but I'd initially look at ~/.bash_history. See what commands have been recently run. This however is rather useless if bash wasn't involved, i.e. access by a file manager, or GUI application.
    – sam
    Jul 10, 2016 at 4:59
  • Depends on if you mean the USB drive could have been plugged to another (unknown) computer and you have to determine this from the drive itself, or if you have access to a computer supposedly used to read a drive.
    – ilkkachu
    Jul 10, 2016 at 14:13
  • I think if the drive is formatted as a FAT filesystem, which is almost always the case, then there won't be anything useful on the drive itself. Jul 10, 2016 at 20:10

1 Answer 1

1

You can check the 'dmesg' output for 'mounted' like so: dmesg -T|grep 'mounted' and if you want monitor it if already mounted you can use inotify but keep in mind this is strictly a linux solution so for Unix you'll need to use some other tool to monitor filesystem activity.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .