2

(This is not just question about when a normal power failure occurred)

My 2017 iMac was stolen today during a break-in, but the internal hard drive was dead so it was running off of an external SSD. They unplugged everything including the external drive and left it behind. I'm trying to figure out if there is a system log that keeps an ongoing record with enough time resolution to figure out close to exactly when the power was unplugged.

I can't boot it up, but I can look through the file system on another Mac. I was able to find a couple of plist files updated most recently, but it only gives me a several-hour window and I'd like to get more accurate if possible. I'm was running Catalina and I'm not able to find anything more recent in ~/Library/Logs/DiagnosticReports/

Are there any very low-level system processes that might have a record? Something like cron (though I wasn't running any scheduled jobs)?

  • This question could be rephrased as "how do I find the most recently modified file on a harddrive?" – Nic Mar 15 at 2:35
  • 1
    Please don’t include answers/solutions in the question, post them below as an answer instead. – nohillside 2 days ago
2

You want to find all files that are newer (based on time of last modification) than the .plist files you've already found. So if this is the name of the .plist file you already know about...

/Users/yourusername/Library/Preferences/whatever.plist

Then you want to use find like this:

find / -newermm /Users/yourusername/Library/Preferences/whatever.plist

You might see some lines like Permission denied -- just ignore those, it's fine.

This will search the whole disk for files accessed more recently than your comparison file. It might take a while. If you get many results, pick one of the results and try the find command again, substituting your newer file into the command. Rinse and repeat until you've found the newest file.

  • This worked, thanks! I made some minor adjustments and posted the exact solution that worked for me in an edit to my original question. – user365609 2 days ago
3

You would need to look through the system log for the last "Shutdown Cause" code.

There won't be anything in cron because it was deprecated in favor of launchd. However, launchd (or cron) wouldn't be of help because those logs show when things are started or error out, seldom do they show when things are shutdown - especially if powered off properly (no error)

To search the log, use the following command:

$ log show --predicate "process == kernel" | grep -i "shutdown cause"

See this answer for further details on how to search the log.

  • 1
    Would that work if they just turned off the power rather than shutting down? Wouldn't it get written on the next boot? – lx07 Mar 14 at 16:07
  • That’s true. Did you have any power saving settings enabled? You could look for the last power nap wake event – Allan Mar 14 at 21:12

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .