Notifications
Clear all
General (Technical, Procedural, Software, Hardware etc.)
2
Posts
2
Users
0
Reactions
796
Views
Topic starter
14/05/2017 7:30 pm
Hi All,
Following the previous post re. USB History I am also testing a E01 image of a mac I created and recorded what I've done for the presence of history of mounted dmg files.
Where should I look for this? So far I've checked this
/Users/"xxx"/Library/Preferences/com.apple.DiskUtility.plist
But there is not much.
Do have any other place I could look for this?
15/05/2017 5:16 am
If you look in the daily.out you should see indications of mounted volumes at the time that the log is taken. It won't necessarily give you the DMG or USB history, but if it's got a unique name that might be of value