I was away from my MacBook Air (Yosemite) briefly and suspected that someone had copied files from my Mac. Here is what I can see from the system.log under console /var/log. Could some experts advise whether this "(non-unique): 000000000820 " log may be sign that some one plugged in an USB drive? What do I need to search for to find out what directory of files were possibly stolen?


Mar 31 21:18:41 This mac kernel[0]: USBMSC Identifier (non-unique): 000000000820 0x5ac 0x8406 0x820, 3
Mar 31 21:18:41 This mac kernel[0]: en0: channel changed to 1
Mar 31 21:18:41 This mac.local FinderSyncAPIExtension[1051]: Pipe path is a symbolic link, connecting to target.
Mar 31 21:18:41 This mac kernel[0]: IOBluetoothUSBDFU::probe
Mar 31 21:18:41 This mac kernel[0]: IOBluetoothUSBDFU::probe ProductID - 0x828F FirmwareVersion - 0x0103
Mar 31 21:18:41 This mac kernel[0]: **** [IOBluetoothHostControllerUSBTransport][start] -- completed -- result = TRUE -- 0xb000 ****
Mar 31 21:18:41 This mac kernel[0]: **** [BroadcomBluetoothHostControllerUSBTransport][start] -- Completed (matched on Device) -- 0xb000 ****
Mar 31 21:27:27 This mac kernel[0]: USB (XHCI Root Hub USB 2.0 Simulation):Port 12 on bus 0xa connected or disconnected: portSC(0xe4202a0)
Mar 31 21:27:27 This mac kernel[0]: The USB device Card Reader (Port 3 of Hub at 0x15000000) may have caused a wake by being disconnected
  • just curious, which log was this? Also, do you remember if you locked the computer or not?
    – Matthew N
    Apr 2, 2018 at 3:36
  • It was the system.log under console /var/log, I did not lock the computer.
    – user283539
    Apr 2, 2018 at 4:50

3 Answers 3


Here's the command for generating a list of all files accessed in the last 72 hours:

sudo find / -atime -72h -ls > output.txt

From there, you can run 'stat' on each file to get the access time.

cat output.txt | while read in; do stat; done > accessTimes.txt

You can narrow your search to a specific date/time range via a text editor or grep command.

grep "Mar 31 21:" accessTimes.txt

This may not be sufficient to prove any wrongdoing, but it can disprove it if there were no files accessed during the window of concern. Also, gives an idea of what was possibly accessed.

  • Thank you. Another question, does "accessing" include files copied to a USB flash stick or other portable USB hard-disk? I did look into the files "accessed" during that period. I only recognized some system files whose names do not ring a bell.
    – user283539
    Apr 2, 2018 at 23:04
  • Yes, access time in the inode updates with a file a copy.
    – Jason
    Apr 3, 2018 at 14:12

The other post, stating that it is impossible to know what this device is, is incorrect.

The line you indicate "USBMSC Identifier (non-unique): 000000000820 0x5ac 0x8406 0x820, 3" actually tells you exactly what kind of device it is:

The number 0x5ac is a Vendor ID that tells you that the device was made by Apple Inc.

The number 0x8406 is a Product ID that tells you that the device is the built-in SDXC card reader in the laptop.

The number 0x820 is the serial number, which is always this number for all the Apple SDXC card readers.

The number 3 is the revision number meaning that this card reader is a revision 3.00.

This means that the device that connected is the internal SDXC card reader inside the laptop. Normally this device is always connected, but it can become disconnected due to for example putting the laptop to sleep.

This tells you that no-one plugged in an external USB drive to your laptop. Instead the internal SDXC card reader simply communicated with the host processor, which it does all the time.


From that log, all you can tell is a USB device was connected or disconnected. It could a USB drive, but then again, that drive could be going to sleep. Someone could have plugged in an iPhone to charge it. The point is, it's impossible to know.

Even if a USB drive was plugged in, there's no way to tell if files were copied from your machine. To see if files were, in fact, copied from (or to) your machine, you need an audit log. Apple comes with one but it's disabled by default.

See this post on OpenBSM.

  • Thank you. You would agree that some USB drive was plugged in during that period to have prompted this logged item? The computer did not have any USB plugged in. Simply sitting here by itself should not have prompted this log, right? Also, I do not understand the code "(non-unique) 000000000820 0x5ac 0x8406 0x820, 3. Does each USB drive has a serial number like 000000000820? Thank you
    – user283539
    Apr 2, 2018 at 23:07
  • Some USBs have unique SN#s and others don't. I have several SanDisk USB drives that show up with the same serial
    – Allan
    Apr 2, 2018 at 23:30
  • Thank you. I imagine there was an attempt to steal files using USB drive since the computer itself would not have prompted the 1st line, right?
    – user283539
    Apr 3, 2018 at 7:04
  • 1
    Can't say for certain. How do you know that the computer didn't wake and "re-attach" a USB device? From the log, we simply cannot tell.
    – Allan
    Apr 3, 2018 at 11:58
  • I knew it because there was no USB device attached to the laptop before I left and after I returned.
    – user283539
    Apr 3, 2018 at 19:00

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .