Hello all,
I'm investigatin on data leakage and I would understand if the suspect copy files from you MAC Pro to uSB thumb driver. What log files I should look for?
Thanks
Are you saying a person used a USB drive to take (copy/cut) files from a Mac Pro running OSX?
And you are looking for log files to indicate the USB was merely connected to the Mac Pro?
Is that all you are looking for?
Was the Mac Pro running OSX with certainty and if so, which version? It's important as log files for USB connection did not exist pre 10.6.4. In 10.8 they moved to a new location.
Intel Mac's are capable of running Windows in a Bootcamp or additionally a virtual environment.
What types of files are you looking for? There are other artifacts which could be of significance if you have any idea of the users sophistication or process.