Forums
Main Category
General (Technical,...
Mac OSX usb analysi...
 
Notifications
Clear all

Mac OSX usb analysis

 
General (Technical, Procedural, Software, Hardware etc.)
Last Post by snyper 9 years ago
3 Posts
2 Users
0 Reactions
1,164 Views
RSS
 snyper
(@snyper)
New Member
Joined: 12 years ago
Posts: 2
Topic starter 28/03/2016 6:40 am  

Hi all,

i am trying to analyse the usb activity on Mac OSX Mountain Lion from an Apple iMac A1418 EMC 2638. I have tried to follow the guide from http//www.appleexaminer.com/MacsAndOS/Analysis/USBOSX/USBOSX.html but this doesn't tell me much besides what was plugged in. I want to find out the date/time a usb device was plugged in. I have also tried searching for "usbmsc" from this guide https://www.blackbagtech.com/blog/2012/11/09/locating-usb-device-connection-artifacts-on-a-mountain-lion-computer/ but received alot of false positives.

Can anyone help me out here? Also if possible, is there any way you can find out what has been copied to a usb?

Thanks in advacne


   
Quote
nightworker
 nightworker
(@nightworker)
Estimable Member
Joined: 16 years ago
Posts: 134
28/03/2016 1:44 pm  

did you acquire live image of the drive when it encrpted you can see some files but not all you probably can not usb artifact keyword vs


   
ReplyQuote
 snyper
(@snyper)
New Member
Joined: 12 years ago
Posts: 2
Topic starter 28/03/2016 1:49 pm  

I don't think the drive had filevault on it as i wasn't prompted to enter a password when i acquired it with Macquisition. I can view all files on the drive.


   
ReplyQuote
Forum Jump:
  Previous Topic
Next Topic  
Share: