Hi
I need to find out if there is a similar registry type key on a Mac as there is on a PC. On PC you can normally see if any USB memory sticks where used on the PC by looking at HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\UsbStor.
But I know the Apple OS X operating system does not have a registry and all the registry info is stored in plist files.
How can I find out if any memory devices where connect to a Apple Mac and if any files were copied to that device?
Thanks
Hi
I need to find out if there is a similar registry type key on a Mac as there is on a PC. On PC you can normally see if any USB memory sticks where used on the PC by looking at HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\UsbStor.
But I know the Apple OS X operating system does not have a registry and all the registry info is stored in plist files.
How can I find out if any memory devices where connect to a Apple Mac and if any files were copied to that device?
Thanks
One problem with the recommendation to look at the Finder plist is that you can stop the Finder from showing icons on the Desktop for mounted media and they then won't appear in the plist. A more reliable, although more volatile as well, source is to look at the system log (\private\var\log\system.log). There will be several logs if you are including ones that are archived by the cron jobs so you have a fairly large source of information to check. If you search on the term "Volumes" in the logs you will see the mount information for every media item that came onlne through disk arbitration or by manually mounting from the terminal and that was available to the OS. This technique will also show you network shares that were mounted.