Could I use the system logs to know if log-ins, log-outs, etc were done in this Mac?…how can I know the user didn’t put the storage into another similar Mac and operated the machine from that mac?
Any books/articles/courses explaining this stuff? (without having to do a degree in digital forensics)
You can use the command line tool last to list sessions of specified users.
I cannot find an online manual that Apple hosts so I found the closest thing I could.
https://www.freebsd.org/cgi/man.cgi?query=last&sektion=1
For example in the terminal.app you could type
last "name of user"
That command get a list of logins (among other data for the said user - see above link for specifics) However should be able to get a sense of when the user was on the computer or not. Therefore determining if the user was on a computer at a given time. This won't tell you what files the user transferred or accessed. But, you might be able to narrow that down if you know what machine a give person was on at a given time.
