7

I have a USB flash drive and I believed someone else may have plugged it in their computer and copied some files.

Using my Mac, how do I know when was the last time my usb flash drive was plugged in?

  • Hi @gun, I believe that what you are looking for may not be possible unfortunately. Can I confirm that what you are looking to do is find out if someone else has used your USB key, and you are worried they have accessed some of the files you had in this key? I believe the answer below shows how to tell when someone last plugged a USB key into your computer. – Chris O'Kelly Sep 22 '14 at 5:50
3

The best evidence you could get is to inspect the last access time of the files in question, or perhaps the last access time of the top-level directory on the file system.

But first, a bit of background. A USB flash drive would be treated by the computer much like a disk. The drive (or, more precisely, the main partition within the drive) would be formatted as a filesystem. Most flash media come formatted out of the box with a VFAT filesystem, which is a lowest-common-denominator solution that works with nearly all devices, including OS X, Windows, Linux, and digital cameras. The next most likely alternatives to VFAT would be HFS+ (the native file system of OS X, which Windows doesn't support at all) or NTFS (the native file system of Windows, supported by any version of Windows released this century, but which has just read-only support in OS X, and is rarely supported on digital cameras).

That background is relevant because different filesystems store the last access time differently. I'm going to work with the assumption that your USB stick is formatted with VFAT. This is important because VFAT filesystems only store the last access date, not the time of day. That would be the best evidence you could hope to collect, assuming that everything else goes right.

To see last access dates in the Finder,

  1. Switch to List view (View → as List (⌘2))
  2. Show the View Options dialog (View → Show View Options (⌘J))
  3. Select "Date Last Opened"

Alternatively, instead of using the Finder, you could use the Terminal to run

stat -x /Volumes/USB-Stick-Name/Path/To/File

to see the Access time of a particular file.


There are some important caveats, though!

First, the act of plugging in the media on your Mac will cause it to be automatically mounted, thus altering the last access time of the top-level directory (and perhaps destroying even more evidence than that). A forensic analysis should require precautions such as mounting the media in read-only mode. Therefore, you would have to suppress the auto-mounting behaviour of OS X, which is not that easy.

Second, your suspected coworker / spy could have taken a similar countermeasure of mounting the media read-only, thus leaving no timestamp as evidence. (There is also no guarantee that the computer that the spy used had its clock set accurately, which would cast doubt on the validity of any timestamp.)

The moral of the story is, if you have any sensitive information to be stored on removable media, encrypt it! The easiest solution would be to use FileVault 2. Note, however, that such encryption would make the USB stick unreadable on any machine other than a Mac.

2

Mount your USB device ReadOnly

For this the easiest way consists in installing Disk Arbitrator and configuring it so as to only mount any device as read-only.

Disk-Arbitrator_setting

The Disk-Arbitrator menu bar icon should switch to red.

Plug in your USB device. There is now no risk that you inadvertantly modify any access time on it.

Search for access times

Let's say that your USB device is mounted as suspicious_USB.

Open a Terminal or xterm window. Let's say that you are sure that you didn't mount your USB device on any computer since 20 days. Within your command line window, run the following commands:

cd /Volumes/suspicious_USB
/usr/bin/sudo find . -atime -21 -exec ls -dluT {} \;

This command will display you any file (even hidden ones) that any operating system might have opened within less than 21 days. The output of this command will display you the detailed last access time of any read or simply touched file or folder. For example this command will show you that a folder was simply opened. THis command will show you that Spotlight ran on your USB key.

If you find anything, you will know when your USB was read.

Limitation of waranty

If our suspected colleague or attackant is as skilled as to read this document and to understand how to use it, he might have mounted your USB device read-only too. Hence he would have left it clean of any access time modification.

In this case I have absolutely no method to show that some file was read on your USB device :(.

  • I apologize for writing here, I found that @daniel reply is great but it would complete solve my problem only if a little step further is undertaken: I digit the string /usr/bin/sudo find . -atime -21 -exec ls -dluT {} \; but I can see only the latest access of each day (example: May 3, 18.30) How can I also view on display all the access of a certain day (for instance, if I want to see if the device was also mounted on May 3 at 12.00)? If it helps (or if it could be relevant) the content of the hdd is a backup made with TimeMachine. Thank you in advance – Doc Brown May 10 '18 at 23:04
  • MacOS X stores with every file only one access time: the last one. – dan May 12 '18 at 9:01
1
  • Open your Console
  • Select system.log
  • Type in the following query in the search pane (upper right hand corner): USBMSC
  • You will see something like kernel: USBMSC Identifier (then an alphanumeric string indicating the USB bus address)
  • The date and time is shown as well. This will let you know the last time(s) a device was connected to a particular USB bus.
  • 2
    If I am reading both the Question and the Answer correctly, he is asking for a way to discover when a particular USB device was plugged into any USB Bus, whereas this answer shows how to discover when any USB device was plugged into a particular USB Bus. I do not actually believe there is a way to see what the asker wants, unfortunately (asssuming I am reading it correctly) – Chris O'Kelly Sep 22 '14 at 5:48
  • → njboot: this answer answers another relevant security question: "How may I see when someone plugged a suspicious USB key on my Mac?". – dan Sep 22 '14 at 14:55
0

For "any USB device" this is certainly not possible, as the standard is for communication.
For USB flash drives, you might try checking access dates of the individual files (don't count on it, often not used anyway, and your own check may overwrite the dates if you're not careful), or the presence of files you know neither you not your computer could have put there (like thumbs.db or RECYCLED for Windows, .DS_Store or .Trashes for mac).

There is little point in having this feature, in a typical consumer product. Even if it were stored in the device's firmware, it would still be dependent on the host computer's clock.

  • "dependent on the host computer's clock" rather than relying on such easily faked data it can instead have a non-resettable counter that increments each time the device is powered. – user56648 Sep 22 '14 at 8:49
  • @andré-daniel Not useful for the OP's purpose unless there were another mechanism (not necessarily on the device) storing the count value at which they, and only they, last accessed it. Only a real-time clock would help, but needs a battery larger than the memory unit. You'd be better off programming a pass-through USB logger/security. But any such solution requires the device to be specifically prepared for this. – kaay Sep 22 '14 at 13:10
  • Yeah I wasn't necessarily saying that for the OP, I just pointed out that there was a way of implementing a "security counter" so that an user can know if the device was used without his consent. – user56648 Sep 22 '14 at 13:12
  • @andré-daniel Understood. Would still require algorithms to reduce the risk of false positives, such as during computer reboots, momentary USB disconnects, "usb power surges", failed mounts, etc, in addition to storing the expected value elsewhere. Not worth the effort. If I were asked to implement it, I'd spend the algorithm space and programming time on making an event logger instead - easier to optimize for proper usage than possible improper scenarios, and storage space is cheap nowadays. – kaay Sep 22 '14 at 13:20
  • Yeah, what I was thinking is to have like a smart card embedded in the USB drive that can log events and can't be (easily) tampered with. – user56648 Sep 22 '14 at 13:22
0

Use Belarc Advisor... run it with Admin privileges... when report is finished search for USB Storage Use in past 30 Days... there you can see type of USB and when last used...

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .