How to find recently connected external disks?

Question

Bit of an emergency so any help really appreciated.

I am trying to work out whether or not the there is a way for me to see the details (specifically names) of external drives that have been connected to my machine in the last 6 weeks. Basically a hard drive with confidential information has gone missing and I would like to see if it was ever connected to my machine, does anyone know how or where I can find this information?

Answer 1

The following commands will show you all the external disks which were mounted upon your Mac during the last 7 days (unless you modified the conservation limit of system logs):

grep mounted /var/log/system.log
zgrep mounted /var/log/system.log.*

---

If you would like to increase your auditing possibility on this sort of event, here is the way (for the ones at ease with the Unix talk):

• open the newsyslog configuration file:

  /usr/bin/sudo vi /etc/newsyslog.conf
  

• change the following line:

  /var/log/system.log                     640  7     *    @T00  J
  

  with:

  /var/log/system.log                     640  30    *    @T00  J
  

  (which means keep 30 versions of my old /var/log/syslog files)

• save this modified /etc/newsyslog.conf.

Answer 2

You can search through the sidebar.plist.

~/Library/Preferences/com.apple.sidebarlists.plist

As for how far back this goes and when its re-written I don't know. I used it once to see if a specific drive was mounted to a system that didn't show up in the system.log .

In the Terminal.app run this command.

defaults read ~/Library/Preferences/com.apple.sidebarlists.plist systemitems | grep "Name ="

This will list all drives that were mounted. The above it user specific plist, if the person had access to other accounts you would have to run the above as them to see their mounted history as well.

Edit:

To find just USB devices check for the entry type 515.

defaults read ~/Library/Preferences/com.apple.sidebarlists.plist systemitems | grep -A 1 "EntryType = 515;"

For Firewire it would be 517:

defaults read ~/Library/Preferences/com.apple.sidebarlists.plist systemitems | grep -A 1 "EntryType = 517;"