How can I watch for a stolen computer?

A friend’s MacBook was stolen this evening. If the thief is stupid and doesn’t immediately wipe the computer, he might just turn it on a surf around the web. When that happens, we expect the computer to show up in the SHARED items list on the sidebar of the home computer as Back to My Mac is configured. However, we can’t sit around and watch the Finder’s sidebar all day long.

I think I am relatively good with Applescript and know nothing about Automator. I have tried to figure out an Applescript command that might get a list of active shared devices but I am having absolutely no luck. Anybody have a suggestion about how to watch for a Back to My Mac connection? Is there an Automator command that will do as such?

Once the stolen computer is seen via Back to My Mac, an alarm could go off to alert us, and then we could connect to watch the person to see if they tip their hat such as logging into Facebook, Twitter, or email…


I haven’t worked with that service yet, but if, and it’s very likely it is, those kind of shared folders show up in the ‘/Volumes/’ directory in your Mac, you could watch the folder ‘/Volumes/’.

Something like this?

property SHARED_FOLDER_NAME : "OSX Leopard"
property WATCH_FOLDER : "/Volumes/"
property SLEEP_TIME : 15 -- check every 15 seconds

on idle
	set folderContents to list folder WATCH_FOLDER
	if folderContents contains SHARED_FOLDER_NAME then
		set volume output volume 100
			tell me to activate		
			set alReply to display alert ¬
				"'" & ¬
				"' is active in directory '" & ¬
				WATCH_FOLDER & "'" giving up after 5
			if gave up of alReply is false then
				quit me
				exit repeat
			end if
		end repeat
	end if
	return SLEEP_TIME
end idle

This application checks the directory WATCH_FOLDER for an item named SHARED_FOLDER_NAME every SLEEP_TIME seconds. If the directory is present, the user is informed with a beep and an alert. If the user clicks OK, the application quits.

You’ll have to save the application as a stay-open bundle.

Success in finding your friend’s computer,


Your code is beautiful as a WATCH FOLDER but only mounted volumes appear in /Volumes/. Computers available for connection / sharing that appear in the sidebar are not mounted thus are not registered in /Volumes/. That is my frustrating problem…

If I’m not mistaken, the shared items in the sidebar is a specific kind of Boujour device on the network. I think this comment applies to the Back to My Mac items. Unfortunately, I don’t know how to manipulate Boujour with Applescript or even terminal.

Please… Any more suggestions?


Are you sure the folder is not mounted anywhere in the filesystem? Because, in Unix (which is the base of Mac OS X), everything is a file.

Yes, BackToMyMac volumes behave like normal shared volumes. They are detected over (Wide Area) Bonjour. The volume appears in the sidebar even if the volume is not mounted.

I wrote a quick&dirty Cocoa program to watch Back To My Mac hosts.
Every time a host appears, an alert panel will be displayed with a trumpet sound.

You can download it here: WatchBackToMyMac.
The application doesn’t have a main window but a menu with a Quit item.

The CPU and RAM consumption of the bonjour browser is quasi zero, because it works with Cocoa delegate notifications.

Good luck to find the thief

No source code? :smiley:

It’s barely more than this

Ha, “Barely” he sais. Well, in my opinion you’re just a great coder who underestimates himself, I haven’t even heard about NSNetServices, but yeah it will be experience I guess.