How do I determine if my hard disk was ever disconnected from my MacBook Pro 2012 and then reconnected? Can I use the Disk Utility log or any other tool? OS X 10.8.5 is the version.

  • 2
    This looks like an XY Problem, so can you describe in more details which problem you are trying to solve here (without already making assumptions about the cause)? – nohillside Oct 15 '17 at 11:54
  • I am trying to get to see if my hard disk that comes with my MacBook was ever disconnected from my MacBook Pro and then reconnected. Is there a way to determine it? Thanks! – stata00 Oct 15 '17 at 12:02
  • 2
    I got that part. The XY part is the "why do you want to know this", or "which problem will be solved by knowing"? – nohillside Oct 15 '17 at 12:03
  • I just would like to ensure that it wasn't disconnected in my absence. – stata00 Oct 15 '17 at 12:11
  • It's a little like wondering whether someone puts on a hat every time you leave the room, only to remove it before your return. Knowing if that was true or not would not gain you anything, in itself. – Tetsujin Oct 15 '17 at 12:19

You can't.

There's no tamper evident devices in the Mac computers. Once you turn off your Mac, there's no logging facility to detect anything by the virtue of it being off.

To draw a parallel comparison, how would you know that someone removed and reattached the transmission in your car after you parked it?

PCs, on the other hand have been using intrusion switches for many years (mostly in the enterprise), but this is just something that Apple hasn't implemented.

You have three options for detecting/preventing tampering with your MacBook:

  • Take it with you. This is the most reliable option; people can't tamper with what they have no access to.
  • Turn on FileVault to protect your data. It's close to impossible to decrypt a drive that's been encrypted and this option will cover you if you lose it if you've "taken it with you."
  • Use video to see who's (if there is one) the culprit. Get a wireless camera to watch/record the area where your MacBook resides (I've used Arlo in my office to see who comes in and rifles through my desk)

Any/all of these will help protect you against malicious users.

  • The simplest answer: add tamper evident seals to the Mac. This is required by some policies (FIPS 140-2, for example). It has the additional advantage of acting as a visible deterrent to casual tampering. (Also works on your analogy: car companies put paint marks on critical bolts to show quality inspection, detect accidental loosening, but also as evidence of tampering) – user71659 Oct 15 '17 at 16:43
  • @user71659 - I didn't add that because getting around a tamper seal is virtually one of the easiest things to do. I've done it countless times. – Allan Oct 15 '17 at 17:28
  • Intrusion switches are even easier (and don't exist on laptops either). Some you just slide a card in the right place. One brand at work has the wires visible through the vents, just fish them through the vent and short them. Intrusion switches only cover the main case opening too, pop open a drive bay door, reach in and hold the switch down. FIPS policy requires all openings to have tamper-evident labels. Video is impractical if you have days of video in a high-traffic area, you'll have to watch it all. And of course, FDE has major weaknesses in integrity. – user71659 Oct 15 '17 at 17:33

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .