How to check whether someone viewed/copied a video?

Is there any way to check if someone (a hacker who had physical access to my machine) has accessed or copied a file (a video) on my system? I really need to know.

Solution 1:

Using the terminal, you could check when the last time the video file was accessed, if this is later than the last time you accessed it, there's a chance he has copied it. Of course if you've accessed the file since then, or can't remember when you last accessed it, this won't be very helpful. By access, I mean copy, play or move the file.

In the terminal, use the command:

stat /path/to/video

You'll get output in the following format:

$ stat file
  File: â?~fileâ?T
  Size: 435             Blocks: 8          IO Block: 4096   regular file
Device: 801h/2049d      Inode: 262181      Links: 1
Access: (0755/-rwxr-xr-x)  Uid: (    0/    root)   Gid: (    0/    root)
Access: 2016-09-12 10:30:01.186634836 +0100
Modify: 2015-10-13 15:18:11.669085522 +0100
Change: 2015-10-13 15:18:11.669085522 +0100
 Birth: -

The information after the Access: line will tell you when it was last accessed.

This method is certainly not foolproof, the access time for the file can be faked, or the system time can be changed for the duration of the file access, then reset to the correct time. It all depends on the skill level of the user that is trying to copy your video. They may not have not have bothered if they were going to blackmail you with it anyway, but there's no way of discerning that information. It's very difficult to track file access without having previously installed an IDS (Intrusion Detection System) such as snort or tripwire.