2

Bit of an emergency so any help really appreciated.

I am trying to work out whether or not the there is a way for me to see the details (specifically names) of external drives that have been connected to my machine in the last 6 weeks. Basically a hard drive with confidential information has gone missing and I would like to see if it was ever connected to my machine, does anyone know how or where I can find this information?

0

The following commands will show you all the external disks which were mounted upon your Mac during the last 7 days (unless you modified the conservation limit of system logs):

grep mounted /var/log/system.log
zgrep mounted /var/log/system.log.*


If you would like to increase your auditing possibility on this sort of event, here is the way (for the ones at ease with the Unix talk):

  • open the newsyslog configuration file:

    /usr/bin/sudo vi /etc/newsyslog.conf
    
  • change the following line:

    /var/log/system.log                     640  7     *    @T00  J
    

    with:

    /var/log/system.log                     640  30    *    @T00  J
    

    (which means keep 30 versions of my old /var/log/syslog files)

  • save this modified /etc/newsyslog.conf.

0

You can search through the sidebar.plist.

~/Library/Preferences/com.apple.sidebarlists.plist

As for how far back this goes and when its re-written I don't know. I used it once to see if a specific drive was mounted to a system that didn't show up in the system.log .

In the Terminal.app run this command.

defaults read ~/Library/Preferences/com.apple.sidebarlists.plist systemitems | grep "Name ="

This will list all drives that were mounted. The above it user specific plist, if the person had access to other accounts you would have to run the above as them to see their mounted history as well.

Edit:

To find just USB devices check for the entry type 515.

defaults read ~/Library/Preferences/com.apple.sidebarlists.plist systemitems | grep -A 1 "EntryType = 515;"

For Firewire it would be 517:

defaults read ~/Library/Preferences/com.apple.sidebarlists.plist systemitems | grep -A 1 "EntryType = 517;"
  • You could narrow it down to entry type, I believe that 515 is USB. – tron_jones Dec 10 '14 at 15:15
  • Thanks guys. I have tried running the Terminal command above and it has some results but not the one I am after. If there was a way to narrow it down by FireWire I think I might have an answer, does anyone know how I'd do that? – KMJO Dec 10 '14 at 15:50
  • I'll edit above to grep for USB or Firewire. Did you check the console.app? That would be the most reliable information. – tron_jones Dec 10 '14 at 15:53
  • Thanks for that. I've run it but it doesn't seem to go back far enough. Can you recommend the best way to search the Console? I'm looking for the first week in November which was 30-40 days ago. I know what the drive was (supposedly) called if that helps? – KMJO Dec 10 '14 at 16:20
  • I don't think you will find anything in the console.app system logs that goes back 30 - 40 days. You can open console.app and check the system.log files underneath /var/log/ and type in "mounted" in the search box on the top right. – tron_jones Dec 10 '14 at 16:26

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .