3

I had a USB flash drive plugged into my MacBook (running Yosemite), but that drive is now missing. Somebody must've taken it (unplugged it) from my computer while I was at work or while carrying it in my backpack.

When I now opened my MacBook, it showed the message that the disk wasn't ejected properly.

Can I find out when it was unplugged? What sort of message am I looking for in the event log?

1

Try the Console log at var/log/asl/2015.04.08.U0.80.asl or similar
(there will also be a G80 & a U501 with similar dates but it's the U0.80.asl you want)

Apr  8 17:38:35 macname kernel[0] <Notice>: disk6s1: media is not present.  
Apr  8 17:38:35 macname kernel[0] <Notice>: msdosfs_fat_uninit_vol: error 6 from msdosfs_fat_cache_flush

Tested empirically on a disposable USB key ;-)

|improve this answer|||||
  • Thanks, I found those messages. Now the question is… if the Mac is sleeping while the drive is unplugged, will the messages be logged with the timestamps of the Mac waking up or when the drive was actually removed? Can't test it now, as I (obviously) don't have a drive to test with anymore :) It seems like it's the time when the Mac wakes up… – slhck Apr 8 '15 at 16:50
  • I can't test that so easily - this machines hasn't slept since it was new, been on 24/7 for 7 years ;-) ...Once I'd found it in asl, btw, it was really easy to find in the All Messages log. I'd guess you're right though, that it couldn't log it til it woke up – Tetsujin Apr 8 '15 at 16:57

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .