iMac connected USB ...
 
Notifications
Clear all

iMac connected USB information

3 Posts
2 Users
0 Likes
786 Views
(@cerveza)
Posts: 21
Eminent Member
Topic starter
 

Hi all,

I have an image of an iMac running Sierra and I’m looking for connected USB information. I know that with the newest Mac OS they have moved all of the logging information around (how helpful).

I have read that the unified logs are stored in two directories

/var/db/diagnostics/
/var/db/uuidtext/

I can find these two directories but I dont really know where to go from there. Which log in these directories hold the USB information? I used to be plist but that’s changed!

I have also read, and I don’t know if this is true, that the logs are only held for 30days. I’m looking for information back in November 2017…

Any help or links to articles that will help me locate the logs I’m looking for so I can parse the info and read it would be super helpful!

Cheers!

 
Posted : 03/02/2018 7:14 pm
gungora
(@gungora)
Posts: 33
Eminent Member
 

I suggest that you take a look at this presentation by Sarah Edwards

https://github.com/mac4n6/Presentations/blob/master/Logs%20Unite!%20-%20Forensic%20Analysis%20of%20Apple%20Unified%20Logs/LogsUnite.pdf

It is a good intro to the topic and contains useful references on the last page for further research.

 
Posted : 04/02/2018 6:33 am
(@cerveza)
Posts: 21
Eminent Member
Topic starter
 

I found this info which I hope will help me.

https://www.blackbagtech.com/blog/2017/09/22/accessing-unified-logs-image/

Any other info is appreciated too

 
Posted : 04/02/2018 5:29 pm
Share: