OK let me try and reformulate your question based on the details you've provided, and my guesses filling in details that you still haven't provided:
"Assume someone has gained access to a unix-like (unix/linux/bsd/etc) computer via a remote connection, and through this connection, may or may not have downloaded or modified some files. Is there any way for me, an authorized user, to see if he did indeed download any files, and if so, which files those are?"
The short answer is "maybe, sort of". Assuming that the attacker gained access to a valid shell account, there's nothing that will differentiate his actions from legitimate actions. However, here is what you can do:
1) find out when the attack happened:
Use the "last" command. This will tell you who logged in, when, and from where. Look for the connection that came from somewhere unusual, and see what times the user was logged in for.
2) find all files modified during this timespan:
You can do this using the "find" command. Read the manual page for more details on how to do this (accessible via "man find" or
http://unixhelp.ed.ac.uk/CGI/man-cgi?find)
Also, step 1) above will tell you what user the attacker logged in as. Check that user's ~/.bash_history file. This file, assuming the attacker did not clear it, will contain a "history" of the commands the attacker typed into the terminal, and can be helpful in uncovering what the attacker did.
Final note: if the attacker gained root access, you
MUST reformat/reinstall the system, or at least replace the kernel and
all system binaries from backups known to be clean. It is the
only way to make sure you don't have any backdoors left open in your system
Best of luck! Let us know what you find