Hi, anybody studied the possbilities to detect if in a MAC has been connected to an USB external Unit?
Thanks
what you mean mac ,mac as timastamp , mac as device adress
if it time stamp yes it is but device adress is only lnk files
what you mean mac ,mac as timastamp , mac as device adress
if it time stamp yes it is but device adress is only lnk files
MAC as MACIntosh?
I bet that the question is actually ?
Is there in MacOSX any structure similar to Windows ShellBags from which one can determine if the computer was connected to a USB external mass storage device?
If yes, what are them and which tool can be used to analyse them?
jaclaz
Hi, anybody studied the possbilities to detect if in a MAC has been connected to an USB external Unit?
Thanks
You can look at a few places
The com.apple.sidebarlists.plist is probably your best bet, but realistically you'll only get that a device has been mounted based on its volume name. So if the volume name is something generic then you wont have much luck
You can check the system log for USBMSC to say that a device was connected. Im not sure if this will give you much. I cant recall if it gives the device ID off the top of my head
Theres also a daily.out or weekly.out log that shows capacity of mounted volumes at the time that the log is created, so you might be able to tie it back that way.
Shoot an email to the guys at blackbag and they may be able to help you out as they are very knowledgable folk