How to check if your computer has been tampered with
There are some easy ways to tell if someone has been using your computer.
Whether you’re in an open office where colleagues regularly wander past, or live somewhere—like a college dorm—where you feel comfortable leaving your laptop unattended in the presence of relative strangers, it can be all too easy for someone else to sneak a look at your computer.
If you want to keep your device secure in communal environments, your best bet is to stop unauthorized access in the first place. Still, there’s some detective work you can do if you suspect someone else has been using your device.
Always make sure you lock your computer
Since prevention is better than a cure, you ideally want to prevent others from accessing your laptop in the first place. A simple way to do that is to lock your laptop behind a password whenever you step away from it.
On macOS, you can get back to the lock screen at any point by opening the Apple menu and choosing Lock Screen, or hitting the keyboard shortcut Ctrl+Cmd+Q. It’s straightforward on Windows, too. From the Start menu, click your avatar, then choose Lock. Alternatively, the Win+L keyboard shortcut works as well.
[Related: How to remove Bing results from your Window Start menu]
If you keep leaving your desk in a hurry or just always forget to lock your computer when you step away from it, set your laptop to lock itself after a certain amount of idle time. On macOS, open the Apple menu and pick System Settings, then scroll down to Lock Screen. Find the option to Require password after screen saver begins or display is turned off, and use the dropdown menu to choose exactly when your computer will lock itself after it’s been idle. You can use the options and dropdown menus right above this to change the time it takes for a screen saver to appear or the display to turn off.
To automatically lock Windows 11, click the Start menu, then the cog icon to open your settings. Then go to Accounts > Sign-in options and find the Additional settings heading. Click the dropdown menu next to If you’ve been away, when should Windows require you to sign in again? and choose When PC wakes up from sleep. To set when your computer should start snoozing, choose System from settings, then Power & battery, and click Screen and sleep to adjust the various options to your liking.
On Windows 10, open the Start menu and hit the cog icon to access your settings. From there, go to Accounts > Sign-in options and make sure the Require sign-in option is set to When PC wakes up from sleep. To set idle time duration, go to your settings and pick System, followed by Power & sleep.
The duration of your PC’s various sleep and idle options is up to you—a shorter time is better for security and battery life, but also means your computer might lock itself while you’re still in front of it if you haven’t touched the keyboard or mouse for a few minutes. Start with something around five minutes, and adjust it if you feel that time is too short.
Check for recent activity
Let’s say you suspect someone might have been able to access your laptop while it was unlocked, or maybe even knows your password. Your next step should be to check for telltale signs of unusual activity inside the most commonly used apps.
Start with your web browser and call up the browsing history to see if someone else has left a trace. From the Chrome menu (three vertical dots in the top right corner of your browser), go to History, then History again; from the Firefox menu (three lines), choose History, then Manage history; from the Microsoft Edge menu (three dots), choose History, then either All to view recent pages in a dropdown menu or the three dots in the top right of that menu followed by Open history page; and from the Safari toolbar on macOS, choose History, then Show All History.
Most programs on your computer have some kind of history or recent files list. In Microsoft Word, for example, click File, Open, then Recent. In Adobe Photoshop, you can choose File and Open Recent. Whatever the applications on your system, you should be able to find similar options.
If you’re not sure what program a would-be laptop infiltrator might have used, check the file system—your intruder might have left something behind on the desktop or in your computer’s download folder, but you can dig deeper, too. On macOS, open Finder from the dock, then switch to the Recents tab to see all the files that have been edited lately. There’s a similar screen on Windows too, accessible by opening File Explorer and clicking Quick Access (this may appear by default).
If you’re still using Windows 10, you’ve got another screen you can check: the timeline. Click the Task View icon on the taskbar, which looks like two stacked rectangles with a scroll bar to their right. If you don’t see it, right-click your taskbar and choose Show Task View button. Scroll down your timeline to find any files that have been opened, websites that have been viewed, and Cortana commands that have been run. The Task View still exists on Windows 11, but it functions differently, and there’s no timeline.
You can dig into absolutely everything that’s happened on your laptop or desktop recently, but the utilities involved are quite difficult to decipher. You might have to run a few web searches to make sense of the information they provide. The utilities will also log all system actions, including those taken by the computer itself. Just because you see activity at a time you weren’t around doesn’t mean someone tampered with your device—it could have run a task itself.
[Related: Set your computer to turn on and off on a schedule]
On macOS, you can do so with the Console—find it by opening Spotlight (Cmd+Space) then typing “console” into the box. If you don’t see anything, you’ll have to click Start streaming to begin viewing system log messages, but this may slow down your computer. These logs will give you a comprehensive list of everything happening on your computer, and you can narrow down the entries via the Search box. Type “wake up” into the box to see all the times your Mac has woken up from sleep, for example.
Over on Windows, you have Event Viewer—look for it in the taskbar search box. Again, it’ll provide you with a mass of information, presented in mostly technical language. Click the right-pointing arrow next to Windows Logs to view a number of subcategories, select System and then right-click System. Choose Filter Current Log, find the Event sources dropdown menu, select Power-Troubleshooter and click OK. This should present you with a list of all the times your laptop woke up.
Get some extra help from apps
If you’re serious about catching laptop snoopers in the act, some third-party software might be in order. One of the best we’ve come across is Spytech Realtime-Spy, which works for Windows or macOS through a simple web interface. You can test out a demo version online, too.
The program shows you the apps that have been used, the websites that have been visited, and the connections that have been made on your computer. It will even take screenshots and record individual key presses. It’s a comprehensive package but will set you back $80 per year.
Another option is Refog, which concentrates mainly on logging keystrokes on your laptop’s keyboard, but which also monitors web usage and takes screenshots. The software costs about $30 per month for Windows or macOS, but there’s a free trial if you want to test it first.
While these programs can alert you to potential snoopers, they can also be used to spy on other people. Of course, we’d strongly advise against doing this. Otherwise, you’re the creep.
This story has been updated. It was originally published on July 20, 2019.