how can you tell from log files that someone was physically at the computer?

background: i've been having harassment issues from a neighbor, and have been suspecting that my might be breaking into my place (picking the lock or something). two nights ago when i went to dinner i wanted it to sound like i was home so i turned the sound on (normally i have the wrong configuration profile for sound chosen as i prefer that computer make no sound - so i selected the correct profile to send the sound through the hdmi to my television speakers) and went to youtube (using firefox) and started a random star trek playlist. I made sure the volume was up and everything was working as needed when i left for dinner. when i returned i noticed a few small things out of place, and that the volume on the computer had been lowered all the way. it was not youtubes volume or the tv volume that had been lowered but rather the system sound (i believe via the little sound icon panel from the desktops bottom menu bar. there is for sure absolutely no way i may have done this by mistake or out of confusion.

in order to get camera footage from the property manager i need to have some sort of proof. so i need to find something, somewhere in the logs that shows that a physical person had to be at the computer. the volume is the thing i know was changed, but there is also a possibility that other things were done. i have no looked into that so much yet as the important thing is to just prove someone was in my place while i was at inner.

other info; i'm running current version lubuntu on an older mac mini. with an apple bluettooth keyboard and and a cheep rf wireless usb mouse with a dongle. the computer most likely didn't sleep as i suspect the playlist on youtube to keep changing the page often enough to avoid suspending.

it would be nice if i could show the volume change specifically but i doubt that's logged, so anything from usb port usage, to bluetooth/keyboard usage will work... like i said.. just anything to show that a physical person was in front of my computer.

i have since taken the computer over to a friends to figure out it where it was plugged in for a few hours and installed ssh and accessed it mostly that way. otherwise it remains unplugged. not sure if taking the hard drive out of the computer and putting it in an external case to access would be better.. any guidance is appreciated. thank you.

  • You haven't told us what Lubuntu you are using, nor what you setup. It's much harder to stop access when people have physical access to the machine (ie. it's easy to not have commands executed when local, change data on your system without booting your actual OS etc - regardless of OS/security). You've currently not given us much - tagging Lubuntu but without release details.. Did you have a BIOS password to disable booting a thumb-drive (therefore your logs may show nothing) - the security varies by make/model (enterprise gear usually has better security; consumer usually little) – guiverc Oct 9 at 10:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.