How to Tell If Someone Touched Your Laptop

Four ways to check what happened while you were away — what each one actually catches, what it misses, and the one method that's certain.

The uncomfortable truth about checking afterwards

Every guide on this topic teaches the same forensics: dig through logs, check recent files. It's worth doing — so we'll cover it properly below. But here's what those guides don't say: the most common kind of snooping leaves no trace at all. Someone who nudges your mouse, scrolls through the document you left open, or reads the chat on your screen generates zero log entries on Windows or macOS. Reading isn't logged. Looking isn't logged. You can run every check below, find nothing, and still have been snooped.

That's why this guide has two halves: the four checks for what already happened, and the tripwire method for next time — which is the only one that gives you a definite answer.

Method 1 — Check login & wake logs

Windows

Press Win + R, run eventvwr.msc, and open Windows Logs → System. Look for Power-Troubleshooter entries — each one records the exact time the machine woke from sleep. For sign-ins, check Windows Logs → Security for event ID 4624 (logon) and 4801 (unlock).

Mac

Open Terminal and run last to list recent logins with timestamps, or pmset -g log | grep -i wake to see every time the lid was opened or the machine woke.

Method 2 — Check recently opened files

On Windows, press Win + R and run recent — a folder of every recently opened file, sortable by time. Quick Access in File Explorer shows the same story. On a Mac, check Apple menu → Recent Items, or in Finder press Cmd + Shift + F for recents with dates.

Method 3 — Check browser history for gaps

Open your browser history (Ctrl/Cmd + H) and scan the window of time you were away. Entries you didn't create are proof. So, interestingly, is a suspicious hole — if history shows activity right up until you left and nothing after, while you know the machine stayed awake, someone may have browsed in incognito or deleted their tracks.

Method 4 — Check uptime and sleep behaviour

If you closed the lid and came back to a warm, awake machine, that's a tell. Windows: powercfg /lastwake in a terminal reports what last woke the device. Mac: the same pmset log from Method 1. Cross-reference wake times against when you were actually at your desk.

What each method actually proves

Method 5 — The tripwire: the only certain answer

Forensics asks "can I reconstruct what happened?" A tripwire asks a better question: "will I know the instant it happens?" Before you walk away, you arm a watcher on the screen. The moment anyone moves the mouse, presses a key, scrolls, or switches windows — it triggers. No log-digging, no ambiguity, no snoop-deletes-the-evidence.

This is exactly what the "Don't Touch My Phone" apps do for phones — a category with tens of millions of downloads — and Desk Guard is the free, browser-based version for laptops and desktops. It works two ways:

Loud mode: a kawaii guard dog (or cat) sits on your screen. One touch and it erupts — barking, a giant flashing CAUGHT YOU, an escalating voice warning — until your secret knock is entered. The snoop is caught, publicly, in the act. You get a shareable citation with the exact time and evidence.

Stealth mode: the screen becomes an innocent sleeping clock. Every touch is silently timestamped. The snoop sees nothing, suspects nothing — and when you return and enter your secret corner-knock, you get a private surveillance report of exactly when your desk was visited. It logs only that contact happened, never what was typed — it is not a keylogger.

One honest caveat

A tripwire only works if it's set before you leave — it can't tell you about yesterday. And none of this replaces real security: if the stakes are higher than curiosity, lock your account every time you stand up (Win + L on Windows, Ctrl + Cmd + Q on a Mac) and use a password. Desk Guard is the layer for the moments in between — the coffee runs, the meeting rooms, the "borrowing" coworkers.

Frequently asked questions