Do encrypted volumes contain any log telling when they were mounted and unmounted? I have several encrypted USB thumb drives and I would like to know whether someone has tried to put them into their computer.


It's generally the practice that logs would be maintained on the system which is doing the mounting etc. On macOS the logs are typically located here: /var/log/system.log.

Matteo's answer here shows the various ways that mounting of devices or DMG image files will show up in this log after they're mounted/unmounted.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .