simple forensic file problem

hi there,

i leant my laptop out and a few things i've been working on have changed, much to my dismay. so i would like to do some mild forensic work to figure out what happened to a couple dmg files.

basically i believe those files were manipulated, but ive already opened them since, so the metadata in "last modified" and "opened" now reflects my last use.

i want to find out if they were opened or modified while the laptop was leant out, as i suspect.

i gather the metadata only stores the last modification or open. is there a history of opens or modifications stored anywhere for files?

alternatively, is there a way to bring up a time-stamped history of disk image mounts?

open to buying apps to solve this problem as it is driving me nuts. but i understand that it may not be possible at all.

thanks!

When you lend out your Mac, don't expect that your privacy will be kept. There is no way to do what you wish unless you have a good friend who works for the NSA or FBI. If you must lend your Mac to someone, set it up so that they can only use the "Guest" account and not yours.

Never ever lend out your computer, your money or your spouse - in that order!

heh yeah, i figured as much. well thanks, i thought i would check if anything was possible! good to be clear that it isnt