Automatic Screen Capture Freaking Me Out!?

[Mr. Monsieur]

Hey folks!

I just discovered a 237GB Quicktime file on my desktop(!) A 49 hour video recording of my screen, which I did not instigate. Not gonna lie...it's kind of freaking me out.

Is this just a glitch in the OS, or are less benign forces at work?

Thoughts? Suggestions?

 

[junkw]

verify with your internet provider bandwidth usage if there has been a 237GB upload to the internet, at least you will know if it was transferred to someone

what are the file owner/group?
[automerge]1577563900[/automerge]
I would definitely enable firewall and install Lulu or Little Snitch

 

[Mr. Monsieur]

Just spoke with my IP...they don't keep logs and allow an infinite amount of D/U.

I looked at the file's metadata...but couldn't find owner/group...where would this appear?

I used to use Little Snitch...time to use it again, perhaps(!)

Thanks so much for your response!

 

[junkw]

stat -x <file>
[automerge]1577566207[/automerge]
lsof <file>

outputs what

 

[Mr. Monsieur]

stat -x <file>
[automerge]1577566207[/automerge]
lsof <file>

outputs what

I copy/pasted that into Terminal, but it didn't output anything...

 

[jpn]

Hey folks!

I just discovered a 237GB Quicktime file on my desktop(!) A 49 hour video recording of my screen, which I did not instigate. Not gonna lie...it's kind of freaking me out.

Is this just a glitch in the OS, or are less benign forces at work?

Thoughts? Suggestions?

nothing really suspicious.

you have that file on yr desk top because you or some one else simply clicked probably mistakenly on the Screenshot app and clicked the Record Entire Screen.
the odd thing about Screenshot is that it continually defaults to the last used position / kind of screen shot you used, so if Record Entire Screen was the last position clicked it continually defaults to that.
the only way to know you are recording yr screen is that it puts an icon in yr menu bar and you click on that icon to end the recording. no other way to end the recording other than a reboot (i would imagine it cant survive a reboot but am not sure).

since its a file / process that records locally Little Snitch would never detect this.

if you REALLY didn't do it by accident yrself, just change yr computer login password as someone DOES have yr login password AND physical access to yr machine. that narrows it down to who did it then, and enough for you to know who did it.

but what its not is Area 51 or Pizzagate.

 

[bogdanw]

Screen recording can be (accidentally) started with Shift + Command + 5 and Return