

Run tcpdump on the traffic back and forth. Set up the laptop to act as a bridge - all packets are passed through. (I would recommend OpenBSD, then FreeBSD just because of easier management) Your best bet is to scrounge an old laptop, ideally with 2 ethernet ports, or, failing that with a PCMCIA network card.

It can do this either immediately, or store locally and periodically spew it to some network destination. If you've been hacked, the keylogger has to report. Is there a list of known possible folders / processes to look for? it's not like the process would be called SpyAgent Helper

I also looked all the processes running at different moments with Activity Monitor but again. I tried scanning all folders in my user's and system Library but nothing rang any bell but since I think any of this software would hide the folder (either by location or name) I don't think I'll find a folder named Employeee Spy Data how can I detect spy software in a iMac running OS X 10.6.8? I have full admin permissions know it.
