were you logged in without the screen lock on?
~$ stat [/path/file]
example: I just opened the file now!
copy would not show here
Code:
barry@deathstar8:~/Documents/SEO$ stat pdf-seo-in-practice.pdf
File: ?pdf-seo-in-practice.pdf?
Size: 10312581 Blocks: 20144 IO Block: 4096 regular file
Device: 805h/2053d Inode: 17171290 Links: 1
Access: (0640/-rw-r-----) Uid: ( 1000/ barry) Gid: ( 1000/ barry)
Access: 2015-10-13 20:15:10.776765541 -0400 THEN
Modify: 2015-10-13 20:12:32.502313729 -0400
Change: 2015-10-13 20:13:07.073977604 -0400
Birth: -
barry@deathstar8:~/Documents/SEO$ stat pdf-seo-in-practice.pdf
File: ?pdf-seo-in-practice.pdf?
Size: 10312581 Blocks: 20144 IO Block: 4096 regular file
Device: 805h/2053d Inode: 17171290 Links: 1
Access: (0640/-rw-r-----) Uid: ( 1000/ barry) Gid: ( 1000/ barry)
Access: 2015-11-11 22:22:24.841280945 -0500 NOW!
Modify: 2015-10-13 20:12:32.502313729 -0400
Change: 2015-10-13 20:13:07.073977604 -0400
Birth: -
barry@deathstar8:~/Documents/SEO$
But that is GNU/LINUX
but Apple is proprietary UNIX -- same or similar CLI command in terminal?
Also check your logs for logins if the screen was locked
~$ tac /var/log/auth.log
or similar (again GNU/LINUX path)