Welcome to the MacNN Forums.

tofusho · Feb 5, 2009, 03:00 PM

I am trying to find ways to find out where my files were cloned / copied to. my co-worker cloned / copied alot of my files and has quit. they have all of my software and libraries. is there a way i can retrieve what drive my files were copied to using terminal?

Big Mac · Feb 5, 2009, 05:15 PM

You think they copied your files to a drive and took it with them? I don't think there's a Terminal command that really tracks that kind of activity. Are you trying to gather proof that they copied the files?

tofusho · Feb 5, 2009, 06:41 PM

yes. i am trying to find a log of some sort to show a date and time stamp and what drive the files were copied. i pulled all console logs, etc and I can show that they sabotaged my machine, but I need a destination drive the files were tranferred. when in terminal, i can get a list of several drives that were accessed through my mac, but that's it.

mduell · Feb 5, 2009, 06:51 PM

Unless they used the terminal to copy the drives (so the commands are in your terminal history), it's not going to be logged.

Leonard · Feb 5, 2009, 08:12 PM

That's why passwords and screensavers with passwords exist. You'd be dead meat at my place of work. There are lots of pranksters at my work place.

P · Feb 6, 2009, 06:33 AM

There are ways to log this sort of activity, but they are not enabled by default.

tofusho · Feb 6, 2009, 11:52 AM

yeah, it's a shame that someone would be this malicious after working here for 4 years. does anyone know if there is software to retrieve this information?

Salty · Feb 6, 2009, 12:25 PM

I know how you can find out...

1) take mastercard
2) enter store
3) buy baseball bat
4) drive to their house
**cencored***
5) smile

tofusho · Feb 6, 2009, 12:30 PM

that...is...AWWWWWSOME !!!!! u really made my day, salty. i needed that. I've been working on this issue for a while now. thx.

ghporter · Feb 6, 2009, 08:43 PM

I'm confused. Did this person walk off with a copy of your files and programs, or did he take them away from you? Your tone makes it sound like he took what you had, leaving without the files, but you explicitly say "copied" and "cloned," so I need some clarification.

If it's just copies that you're missing, there are civil remedies for this sort of thing. Your own files are YOUR intellectual property and you can use the same civil law that the big software companies use to quash piracy. And you can report the person to the software companies that published the programs he took.

If he TOOK your stuff, leaving you nothing, it's similar but it's now a criminal issue.

Ted L. Nancy · Feb 8, 2009, 05:36 PM

Originally Posted by ghporter

If it's just copies that you're missing, there are civil remedies for this sort of thing. Your own files are YOUR intellectual property and you can use the same civil law that the big software companies use to quash piracy. And you can report the person to the software companies that published the programs he took.

If he TOOK your stuff, leaving you nothing, it's similar but it's now a criminal issue.

Yes and no, but it really is no matter. You are on the right track in that you need to get more evidence. From the answers here, it doesn't sound like there is an viable way to get the evidence you are seeking.

Cold Warrior · Feb 8, 2009, 06:15 PM

If you are fairly certain the guy stole your stuff, just report him to the police. They'll get a warrant to search his place and find the computer files. If it's from your workplace, then your business should consider it their intellectual property too, and they should protect it.

Todd Madson · 03:42 PM

It is very possible using easily available tools to clone your drive without any evidence of said copy occurring because your operating
system need not be booted for this to occur.

However, most software has specific serial numbers. And, that cloning would mean the clone of the drive would go into a very specific
computer, i.e. same model and type of the one you have now. Do you know if the person who copied the data talked about having the
same model computer?

Easiest way to thwart the miscreant is to contact the software manufacturers for which you have serial numbers and explain the situation
to see if the software manufacture can invalidate that copy and give you a new serial number.

That way the next time his software calls home it might shut that software down if the manufacturer of said software has that ability.

But, there's little you can do other than realizing the guy has bad karma on him now.