Did someone copy files from my Mac?

Here's the command for generating a list of all files accessed in the last 72 hours:

sudo find / -atime -72h -ls > output.txt

From there, you can run 'stat' on each file to get the access time.

cat output.txt | while read in; do stat; done > accessTimes.txt

You can narrow your search to a specific date/time range via a text editor or grep command.

grep "Mar 31 21:" accessTimes.txt

This may not be sufficient to prove any wrongdoing, but it can disprove it if there were no files accessed during the window of concern. Also, gives an idea of what was possibly accessed.


The other post, stating that it is impossible to know what this device is, is incorrect.

The line you indicate "USBMSC Identifier (non-unique): 000000000820 0x5ac 0x8406 0x820, 3" actually tells you exactly what kind of device it is:

The number 0x5ac is a Vendor ID that tells you that the device was made by Apple Inc.

The number 0x8406 is a Product ID that tells you that the device is the built-in SDXC card reader in the laptop.

The number 0x820 is the serial number, which is always this number for all the Apple SDXC card readers.

The number 3 is the revision number meaning that this card reader is a revision 3.00.

This means that the device that connected is the internal SDXC card reader inside the laptop. Normally this device is always connected, but it can become disconnected due to for example putting the laptop to sleep.

This tells you that no-one plugged in an external USB drive to your laptop. Instead the internal SDXC card reader simply communicated with the host processor, which it does all the time.