On Mar 6, 2020, at 9:14 AM, Jeff @ SLYN Systems <slynsystems1985@...> wrote:

A friend of mine with an iMac lost her husband. She has reason to believe that someone tampered with important financial documents on her computer after his passing.
Is there a way to look at the history to see when a page from the document was dragged to the desktop? She doesn't need "legal" proof but does need to have enough info to confront the person who might have done this. She was also the most recent person to open the document so having that info isn't enough.
If you can help her, I'd like to put the 2 of you in touch with 1 another.
Thanks much,
Jeff

开云体育

Here's a Google search that might help.

Jane

开云体育

On Mar 6, 2020, at 10:30 AM, John Robinson via Groups.Io <profilecovenant@...> wrote:



Jeff,

The only way I can think of would be the TimeMachine backups, you can see from below that there are several backups for each day…

Inside the Documents portion all her items would be listed, as you see on mine.

Then clicking on the Mac HD you can see what’s on the Desktop. (Second screenshot).

So, if the document in question was inside a folder in Documents on 3/5/20 but one of the backups on 3/6/20 showed it on the desktop, she knows when it was moved.

I hope this helps, and hopefully she used TimeMachine.

John




<Pasted Graphic.tiff>

<Pasted Graphic 1.tiff>

On Mar 6, 2020, at 9:14 AM, Jeff @ SLYN Systems <slynsystems1985@...> wrote:

A friend of mine with an iMac lost her husband. She has reason to believe that someone tampered with important financial documents on her computer after his passing.
Is there a way to look at the history to see when a page from the document was dragged to the desktop? She doesn't need "legal" proof but does need to have enough info to confront the person who might have done this. She was also the most recent person to open the document so having that info isn't enough.
If you can help her, I'd like to put the 2 of you in touch with 1 another.
Thanks much,
Jeff