How do I determine if my hard disk was ever disconnected from my MacBook Pro 2012 and then reconnected? Can I use the Disk Utility log or any other tool? OS X 10.8.5 is the version.
There's no tamper evident devices in the Mac computers. Once you turn off your Mac, there's no logging facility to detect anything by the virtue of it being off.
To draw a parallel comparison, how would you know that someone removed and reattached the transmission in your car after you parked it?
PCs, on the other hand have been using intrusion switches for many years (mostly in the enterprise), but this is just something that Apple hasn't implemented.
You have three options for detecting/preventing tampering with your MacBook:
- Take it with you. This is the most reliable option; people can't tamper with what they have no access to.
- Turn on FileVault to protect your data. It's close to impossible to decrypt a drive that's been encrypted and this option will cover you if you lose it if you've "taken it with you."
- Use video to see who's (if there is one) the culprit. Get a wireless camera to watch/record the area where your MacBook resides (I've used Arlo in my office to see who comes in and rifles through my desk)
Any/all of these will help protect you against malicious users.