Anti-theft protection with Automator

So, you want to protect your precious mac from thieves. Well, you’ve come to the right place. Sort of.
This is more of a “try-to-catch-or-at-least-get-a-glimpse-of-the-bastard-who-did-it” kind of solution than a real anti-theft one.

I love my mac. And all of my precious work is on it. I mean I do have backups and stuff but still, having my mac stolen would suck.
So I started looking around for stuff that could protect me in some way. I did find a lot of interesting stuff, including:
- password-protect it
- tie it to the desk with a kensington cable
- sound loud alarm and flash screen and maybe the bastard will get scared and run away
- buy a subscription to a service that fakes a malfunction of the mac, then hope the thief takes it to the repair shop, then pop up a message like “this mac was stolen. contact the police or something”
None of the above struck a chord, since i wanted something simple, customizable and free.

Anyway, the ideea is to use Apple’s Automator in an application that runs on boot to do the following:
- Snap a picture of the bastard (using iSight)
- Take a screenshot of the current desktop
- Save those two files locally
- Scale files
- Send them via FTP
- Wait for 30 seconds and repeat

- A mac with integrated iSight camera
- OS X and Automator
- The little isightcapture utility
- Write access to a FTP server


1. Create directories to work in

The following illustrate my choices, you should replace with whatever you like:

“/Users/Square/mac_capture” – main location
“/Users/Square/mac_capture/captures” – initial location of captured files
“/Users/Square/mac_capture/sent_captures” – local storage for captured and sent files

2. Create the Automator workflow

Open up Automator (should come with OS X), you cand find it in “Applications” – I use Leopard so setting might differ a bit if you’re using something else.
Choose “Custom Workflow”.

Updated 24th of February 2009: Added a new action on top of all the others in order to hide the application!
(found a hint on an apple forum but can’t really remember where…)
Drag the “Run Applescript” action to the workflow and type in:

on run {input, parameters}

    tell application "Automator Launcher" to quit
    tell application "System Events"
        set visible of process "Google Helper" to false
    end tell

    return input
end run

This hides the annoying status bar message (and also assumes you’ve named your application “Google Updater”. That seemed like a good name to me :)

Run AppleScript

Run AppleScript

Drag the “Run Shell Script” action to the workflow – this uses a small utility to capture an image using iSight

cd /Users/Square/mac_capture
./isightcapture captures/camera_capture.jpg

Run Shell Script

Run Shell Script

We’ll get back to using “isightcapture” in just a little bit.

Drag the Get Specified Text action in the workflow – this specifies the captured image path
Type in:


Get Specified Text

Get Specified Text

Drag the Rename Finder Items action in the workflow – this renames file to include date
Use these settings:

Rename Finder Items

Rename Finder Items

Drag the Rename Finder Items action again in the workflow – this renames file to include time
Use these settings:

Rename Finder Items

Rename Finder Items

Drag the Set Computer Volume action – this is used to mute the computer becouse the “take screenshot” action makes a sound (and that’s no good)

Set Computer Volume - to mute

Set Computer Volume - to mute

Drag the Take ScreenShot action – this snaps a picture of the current screen

Take ScreenShot

Take ScreenShot

Set Computer Volume – set it to half the level

Set Computer Volume - to half

Set Computer Volume - to half

Scale Images – scales the screen capture image to 60% (so it won’t take to long to upload to FTP)

Scale Images - 60%

Scale Images - 60%

Get Specified Text – handle to the screen capture file

Get Specified Text

Get Specified Text

Drag again two Rename Finder Items to add date and time, just like above.

Drag a ftp_transfer action and input you details.

You need FTP write access to a domain. Specify you username, password, remote path and local path,
and don’t forget to select “Put to ftp”:



Updated 24th of February 2009: I discovered pretty soon that if the Internet connection isn’t working, the remainder of the workflow will move the captured files to a new directory anyway. That was no good. The way it should work is that if it fails to connect via FPT, it should keep the files, and try to upload them the next time. So I added a little AppleScript that takes into account the fact that “ftp_trasnfer” returns “Not connected.” in case of failure:

Drag the “Run Applescript” action to the workflow and type in:

on run {input, parameters}

	if (input as text) contains "Not connected." then
		tell application "Google Helper" to quit

	end if
	return input
end run

(this also assumes you’ve named your application “Google Updater”)

Run AppleScript

Run AppleScript

Get Specified Finder Items – get a path to the “captures” folder

Get Specified Finder Items

Get Specified Finder Items

Get Folder Contents – retrieve the captured images from the folder

Get Folder Contents

Get Folder Contents

Move Finder Items – move captured files to “sent_captures” to store them locally:

Move Finder Items

Move Finder Items

That’s about it. You can test the workflow and see the results in both the local directories and the FTP location.

NOTE: You might want your workflow to take continous shots since just one image might not be enough. Just a Delay action and specify the time (say, 30 seconds) then add a Loop action and specify the duration or the times you want it to repeat.

Now save it, and then save it as application.

3. View images from FTP

Your images are now stored both on the computer and the FTP server (if there’s a working internet connection, of course). But how about viewing the images?

Use you preffered editor to create a new file, index.php in the same location as the files:



Now use the following code inside the file:

function retrieveDate($string) {
	$date = substr($string, 15);
	$date = substr($date, 0, -4);
	return $date;
$imgdir = getcwd(); // the directory, where your images are stored
$allowed_types = array('png','jpg','jpeg','gif'); // list of filetypes you want to show
$dimg = opendir($imgdir);

while($imgfile = readdir($dimg))
		$a_img[] = $imgfile;
		reset ($a_img);

$totimg = count($a_img); // total image number
for($x=0; $x < $totimg; $x++)
	$size = getimagesize($imgdir.'/'.$a_img[$x]);

	$find = strpos($a_img[$x], "camera_capture");
	if ($find === 0)
		$images_camera[] = $a_img[$x];
	$images_screen[] = $a_img[$x];

<? foreach ($images_camera as $image) : ?>
	<div style="float: left">
		<a href="<?=$image?>">
			<img src="<?=$image?>" alt="<?=$image?>" style="width: 200px" />
			<br />
<? endforeach ?>

<hr style="clear: both" />

<? foreach ($images_screen as $image) : ?>
	<div style="float: left">
		<a href="<?=$image?>">
			<img src="<?=$image?>" alt="<?=$image?>" style="width: 200px" />
			<br />
<? endforeach ?>

That will create a listing of images and name, plus links to the full size image.

Now YOU have a fighting chance! :)


isightcapture is a program that lets you capture images with isight, from the command line.
It is created by Axel Bauer and you can download it here:


For the application to be any good, you need to make it start at boot time. That’s fairly easy. You also need it to be as invisible as possible. I can hide it from the dock but there’s a status message in the menu bar that I just can’t get rid of. Will post my findings later on.

Updated 24th of February 2009:
See the first workflow action for the means to hide the status bar message.
Also, to hide the application icon in the dock, try this:
- right-click the application in Finder
- select “Show Package Contents”
- open Contents -> Info.plist in some text editor
- change “false” to “true” under the line <key>LSUIElement</key>

This is “work in progress” and certainly far from perfect. Please leave a message if you feel you can contribute in any way.

Update: I thought it might be usefull to include the actual workflow as a download.
Please note this WILL NOT WORK unless you modify the actions to match your file system structure.

Automator workflow download (Google

Tags: , , , , , , , ,

20 Responses to “Anti-theft protection with Automator”

  1. Reader says:

    Great! Thank you very much!
    I always wanted to write in my site something like that. Can I take part of your post to my blog?
    Of course, I will add backlink?

    Sincerely, Your Reader

  2. Squirrel says:

    Thanks. Yeah, sure. Also send me a link to the final post.

  3. [...] iSight, sous X.4 ou X.5 (Tiger ou Leopard quoi…) ? Bien, si la protection vous intéresse, ici se trouve un petit tuto sur le pourquoi du comment faire prendre en photo (et eventuellement [...]

  4. miceblue says:

    Does this Automator workflow work on OSX 10.5? I can’t find the “ftp_transfer” command.

  5. miceblue says:

    *I meant 10.5.6 Leopard*

  6. Squirrel says:

    Hi. I have 10.5.6 right now.
    Not sure why the “ftp_transfer” action isn’t there, but you can get it from the apple automator website if you want:

  7. BurtonGeorge says:

    Hi, I’m new to automator – I kept getting errors on the get specified text and rename finder item actions but found that placing a new action and deleting the old one seemed to do the trick. Wow, this is awesome thanks for your hard work. Any news on hiding the application more?

  8. Squirrel says:

    Glad to hear you got it to work!
    About the “hidding the application” bit, yes, I’m happy to say I think I nailed it down. See the updates in the original post (24 Feb 2009)
    (it might sometimes happen that the status message still appear for a split second. I thought that was ok though)

  9. dave says:

    Thank for this great script. It works great for the most part but I’ve had a few problems:

    1. the screen capture jpg worked 100% but the camera capture jpg didn’t rename (to add the date/time). Because of this, there was only one camera file instead of ongoing creation of files.

    THE FIX:
    After the “Run Shell Script”, use “Get Specified Finder Items” instead of “Get Specified Text” as listed above.

    2. I’ve added your Feb 24 update (no internet connection) but noticed that if there’s no internet connection, it completely stops the scrip (even though I set it up on a loop). Is there a way to let it continue the loop (taking camera & screen captures) and ftp them when it re-detects net connection?

    3. I’m using iAlertU. Is there a way to auto-start your script only when iAlertU (or Lockdown) is active instead of on every OS startup?

    4. I found no need for muting the sound on screen capture since (at least in OS 10.5.7) the capture doesn’t make any sound.


  10. serge says:

    Nice idea and cool implementation,

    I thought you might as well capture some internet related information (ip adress, provider node, location etc) using something like the output of a traceroute to any server, and send this info
    at each boot…This could help find the place where the stolen mac is used from…Ideally it
    should be a stealth process, burnt in the boot rom… Thanks to Apple for thinking to it
    for the next macbooks !

  11. Marc says:

    I really like your approach to a good idea.
    However, instead of taking photos/screenshots at a 30 second delay, I think it would be more convenient if you could activate it remotely. For example, one could change the contents of an online text file hosted at your webserver, which would then activate this program. Therefore, you would only activate the program when you know your mac has been stolen.

  12. Squirrel says:

    Since posting this I’ve modified things a little to suit my own needs. I’ve given up on uploading files to FTP and instead email them to myself. It seems that’s rather simple to do.
    My current setup includes:
    - Run AppleScript (hide the application)
    - Run Shell Script (launch isightcapture)
    - Get specified text (get path to captured image)
    - Rename Finder Items (add date and time to file name)
    - Run Shell Script (email the resulting image)
    … and repeat everything for the screen capture.

    The email part is simple:
    After “Rename Finder Items” just add “Run Shell Script” and put in:
    for f in “$@”
    uuencode $f camera_capture.jpg | mail -s ‘Mac Capture CAM’

    Also, I thought it would be better to use OS X’s own system for recurring tasks so the part with the 30 second delay is out of the script. (I did a bit of research but never really wrote everything down, but if there’s any interest I might write a little about how to do it, although you can find that info elsewhere)

    You idea is pretty nice though, I’ve only thought about doing that locally, never remotely. I think I’ll look into that when I have some time, thanks.

  13. Scg2009 says:

    does this work with 10.6 ?

  14. Francesco Gelabert says:

    I really love this webpage. Iwish I could come here everyday\all day.

  15. MRG13 says:

    Wow, this works really well! Thanks for the clear and extensive walkthrough.

    I had to make some changes though, and I have three questions.

    1) A bit of a n00b question: when would you have this script run? I would think every time someone opens my Macbook, unless they press some secret key combination. So, that would need some extra script: “run me on start up or wake up” and “stop me when [some key combo] is pressed”. Could you perhaps help me with that?

    2) How can I supress the small light next to the cam? Everytime a shot is taken, the light is on which is very much like shouting “Well hello there, I’m taking your picture!” ;-) Is there any way to turn off the light?

    3) Both the screen and the cam are captured which is great! But, I can’t figure out how to attach the pictures to the mails that are sent. How do I do this?

    Currently, my workflow is:

    - Run Apple Script
    - Run Shell Script
    - Set Computer Volume
    - Take Screen Shot
    - Set Computer Volume
    - Scale Images
    - Get Specified Finder Items
    - Get Folder Contents
    - Rename Finder Items (2x)
    - Run Shell Script (the e-mail stuff)
    - Run Apple Script
    - Get Specified Finder Items
    - Get Folder Contents
    - Move Finder Items
    - Pause
    - Loop

  16. Squirrel says:

    Hope you had fun with this!
    A quick reply to your questions:
    1. you might want to look into cron, crontab, or the LaunchDaemons and LaunchAgents, I think they’re called now. Also check out CronniX
    2. I’ve never heard of any way to suppress the green led, sorry.

    As I am man enough to admit when someone else did a far better job than me, I have to point you to another product I recently discovered.
    It’s called prey and basically does the same thing (cam capture, screenshot, plus some basic network info and some wi-fi stuff). What’s cool about it is that you can choose to use their control panel (I think that’s a payed option, with a nice little interface and stuff, keep screenshots there, decide when to turn it on/off, etc) OR (the route I took) use it in a sort of “manual mode”, for free, (you put or delete a file on some ftp server and, if the file is missing, it starts taking pictures).
    Sure, I loved customizing everything and learning some Automator stuff (as I’m sure many of you do), but this is a cooler, simpler product…

  17. MRG13 says:

    Thanks for the quick reply! I’ll check out prey for sure.

    Still, could you tell me how to attach the pictures to the emails? They now get sent without them. I like your setup so much I’ll be building other things based on this :)

  18. Squirrel says:

    I’ve searched and searched and found it! :)
    I’ve never dug into the command line much but this lets you send an image attached:

    for f in "$@"
    uuencode $f camera_capture.jpg | mail -s 'Mac Capture CAM'

    It loops through the files which are the result of the above action.
    I used it twice (once for the camera capture and one for the screen capture, so you get 2 emails)
    To make this all simple, here’s the latest version of the workflow I had before I stopped using it (of course, it won’t work out of the box since it contains my system paths)
    Download workflow

  19. MRG13 says:

    That’s the same code as you already posted earlier in the comments ;) I have tried that, but the images just don’t get attachted. I also tried putting the email script before the renaming actions, figuring “camera_capture.jpg” is not to be found anymore after renaming, but still no attachments..

    I found some different code that does work:

    cd /Users/MRG/Mac_capture/captures

    for f in $FILES
    uuencode $f $f | mail -s ‘Mac Capture CAM’

    Any idea how to attach both camera_capture.jpg and screens.png to the same email?

  20. Squirrel says:

    You’re right about it being the same code… Just noticed that :)
    I have no idea how to attach both images, sorry…

Leave a Reply