I need to check the list of files accessed in my computer (ex: yesterday on particular time). Is it possible?
I need to check whether anybody accessed my computer (when I left it unlocked) or not for a particular time.
I assume that you don't think that your computer has been totally compromised (to check who has been running sudo commands see
1) To find all files NOT owned by your logged on user in your home folder, type:
1.1) To find all files that do not belong to any legitimate user (they should not exist), type:
2) As files on the system have three timestamps called
For each of these commands, the same command switches are used: for example,
3) To combine my approaches so far, you could enter the following commands from your home folder:
If your computer were to have been locked, then you could check the auth log which notes each login and unlocking event with a date and time.
There is no direct way to know if someone was accessing an unlocked computer, without having a special program installed to track activity. But indirect information can be used to infer access.
Browser history for instance will often tell you what time websites were accessed. Also gnome's recently accessed files will show opened files. You can get to this by going to Unity's Dash Menu and click expand on the recently used files section:
If you need a more definitive list (including files accessed by non-gnome programs) then we would need to write a short script to detect all files with access or write times between the suspected range. Perhaps someone already has written this but I've never heard of it.