1

I was away from my MacBook Air (Yosemite) briefly and suspected that someone had copied files from my Mac. Here is what I can see from the system.log under console /var/log. Could some experts advise whether this "(non-unique): 000000000820 " log may be sign that some one plugged in an USB drive? What do I need to search for to find out what directory of files were possibly stolen?

_____________________BEGIN______________________

Mar 31 21:18:41 This mac kernel[0]: USBMSC Identifier (non-unique): 000000000820 0x5ac 0x8406 0x820, 3
Mar 31 21:18:41 This mac kernel[0]: en0: channel changed to 1
Mar 31 21:18:41 This mac.local FinderSyncAPIExtension[1051]: Pipe path is a symbolic link, connecting to target.
Mar 31 21:18:41 This mac kernel[0]: IOBluetoothUSBDFU::probe
Mar 31 21:18:41 This mac kernel[0]: IOBluetoothUSBDFU::probe ProductID - 0x828F FirmwareVersion - 0x0103
Mar 31 21:18:41 This mac kernel[0]: **** [IOBluetoothHostControllerUSBTransport][start] -- completed -- result = TRUE -- 0xb000 ****
Mar 31 21:18:41 This mac kernel[0]: **** [BroadcomBluetoothHostControllerUSBTransport][start] -- Completed (matched on Device) -- 0xb000 ****
Mar 31 21:27:27 This mac kernel[0]: USB (XHCI Root Hub USB 2.0 Simulation):Port 12 on bus 0xa connected or disconnected: portSC(0xe4202a0)
Mar 31 21:27:27 This mac kernel[0]: The USB device Card Reader (Port 3 of Hub at 0x15000000) may have caused a wake by being disconnected
  • just curious, which log was this? Also, do you remember if you locked the computer or not? – Matthew N Apr 2 '18 at 3:36
  • It was the system.log under console /var/log, I did not lock the computer. – user283539 Apr 2 '18 at 4:50
3

Here's the command for generating a list of all files accessed in the last 72 hours:

sudo find / -atime -72h -ls > output.txt

From there, you can run 'stat' on each file to get the access time.

cat output.txt | while read in; do stat; done > accessTimes.txt

You can narrow your search to a specific date/time range via a text editor or grep command.

grep "Mar 31 21:" accessTimes.txt

This may not be sufficient to prove any wrongdoing, but it can disprove it if there were no files accessed during the window of concern. Also, gives an idea of what was possibly accessed.

  • Thank you. Another question, does "accessing" include files copied to a USB flash stick or other portable USB hard-disk? I did look into the files "accessed" during that period. I only recognized some system files whose names do not ring a bell. – user283539 Apr 2 '18 at 23:04
  • Yes, access time in the inode updates with a file a copy. – Jason Apr 3 '18 at 14:12
0

From that log, all you can tell is a USB device was connected or disconnected. It could a USB drive, but then again, that drive could be going to sleep. Someone could have plugged in an iPhone to charge it. The point is, it's impossible to know.

Even if a USB drive was plugged in, there's no way to tell if files were copied from your machine. To see if files were, in fact, copied from (or to) your machine, you need an audit log. Apple comes with one but it's disabled by default.

See this post on OpenBSM.

  • Thank you. You would agree that some USB drive was plugged in during that period to have prompted this logged item? The computer did not have any USB plugged in. Simply sitting here by itself should not have prompted this log, right? Also, I do not understand the code "(non-unique) 000000000820 0x5ac 0x8406 0x820, 3. Does each USB drive has a serial number like 000000000820? Thank you – user283539 Apr 2 '18 at 23:07
  • Some USBs have unique SN#s and others don't. I have several SanDisk USB drives that show up with the same serial – Allan Apr 2 '18 at 23:30
  • Thank you. I imagine there was an attempt to steal files using USB drive since the computer itself would not have prompted the 1st line, right? – user283539 Apr 3 '18 at 7:04
  • Can't say for certain. How do you know that the computer didn't wake and "re-attach" a USB device? From the log, we simply cannot tell. – Allan Apr 3 '18 at 11:58
  • I knew it because there was no USB device attached to the laptop before I left and after I returned. – user283539 Apr 3 '18 at 19:00

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .