1

I physically lost my laptop containing some sensitive information and it was picked up by a stranger. I was of course over confident and didn't have it password locked. He was very courteous in returning it the next morning but something about him struck me as a little odd. I wanted to try to verify whether he had tried to copy any of my sensitive information.

I had gmail open at the time and so when he opened the computer gmail logged the IP address he connected to. I thought it was odd that it was an IPv6 address. I didn't think these were assigned by ISPs yet. I also did the easy checks- there was nothing suspicious in the browser history and my recent terminal commands were all things I had entered.

Is there anything else I can check? The items I would be concerned about are mass transfers or logins to websites with saved passwords. Obviously I'm never going to be able to check everything but I'd like to know about plausible next steps. Also, I'm on MacOS.

Of course, I've changed all my passwords and changed the system that led to the computer being physically lost.

6
  • Other than usernames/passwords, what sort of sensitive data do you have? Jun 28, 2017 at 19:19
  • Tethering the computer to a cellular data connection may have been the cause of an IPv6 address. Jun 28, 2017 at 20:41
  • Check the event log if any logon or shutoff occured. If there is none then this stranger probably did nothing. Probably.
    – BlueWizard
    Jun 28, 2017 at 21:22
  • 1
    There's been a strong push to get IPv6 out for the past six and a half years (ever since World IPv6 Day). Yes, it's less common than IPv4, but not dramatically so.
    – Mark
    Jun 28, 2017 at 22:05
  • @user52472 There are some documents with trade secrets.
    – ericksonla
    Jun 28, 2017 at 23:15

2 Answers 2

3

It depends on your level of paranoia

Depending on the skills and maliciousness of this stranger there are many things he might have done.

  • Login to any account with credentials stored in your browser (easy)
  • Read your emails looking for sensitive info (easy)
  • Send spam emails to all of your contacts (easy)
  • Copy your documents to a USB drive (easy)
  • Clone your entire hard drive to extract things like credit card numbers and other sensitive info (intermediate)
  • Install some sort of virus to gain control of your laptop and spy on you at a later date (OS X can get viruses, they are just much rarer than Windows) (intermediate)

After changing passwords, you should probably scan for viruses. Apple's Customer Support can help you with this. If you're a really paranoid person, you might even want to reinstall OS X. Also, watch out for your identity being stolen in case Mr. Stranger found your credit card number or something similar when he potentially searched your hard drive.

IPv6

Many ISPs have already begun to partially implement IPv6. I have Comcast and I have IPv6 up here in Minnesota.

1

This sort of forensic work is easier to do if logging is enabled in advance, but you may still be able to find something. I would check the following items

  1. System.Log - if someone has plugged in a USB device, there may be a note of it in here. The system logs do get overwritten at some point, so you may not find anything in here.
  2. File Last Access Date Time - The filesystem does keep the last date/time the file system was accessed. If you have not accessed these files after you recovered your machine, check the Last Accessed Time.

This is not an exhaustive list of forensic tools/techniques. I'm not the most familiar with macOS, so you may be able to get a more detailed answer on the apple SE.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .