±Forensic Focus Partners

Become an advertising partner

±Your Account


Username
Password

Forgotten password/username?

Site Members:

New Today: 1 Overall: 35520
New Yesterday: 6 Visitors: 127

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

±Latest Webinars

Disk Utility History Mac OS Sierra

Computer forensics discussion. Please ensure that your post is not better suited to one of the forums below (if it is, please post it there instead!)
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
 
  

pajkow
Senior Member
 

Disk Utility History Mac OS Sierra

Post Posted: May 14, 17 18:30

Hi All,

Following the previous post re. USB History I am also testing a E01 image of a mac I created and recorded what I've done for the presence of history of mounted dmg files.

Where should I look for this? So far I've checked this

/Users/"xxx"/Library/Preferences/com.apple.DiskUtility.plist

But there is not much.

Do have any other place I could look for this?  
 
  

randomaccess
Senior Member
 

Re: Disk Utility History Mac OS Sierra

Post Posted: May 15, 17 04:16

If you look in the daily.out you should see indications of mounted volumes at the time that the log is taken. It won't necessarily give you the DMG or USB history, but if it's got a unique name that might be of value  
 

Page 1 of 1