How can I know if a user plugged an external storage device (such as an external hard drive) and moved/copied any data to and from it? Is this recorded in any system logs?. Any article or resource explaining this?
asked Jul 12, 2018 at 21:28
-
I'm unsure about past activity, but you could definitely monitor for this manually, if you can run a program on the computer.– EzekielCommented Jul 12, 2018 at 21:34
-
apple.stackexchange.com/questions/140903/… mount history, but not file activity.– user1787331Commented Jul 12, 2018 at 22:47
Add a comment
|