Can I find out the last time a specific USB was connected to my MBP?

apple.stackexchange https://apple.stackexchange.com/questions/366132

  •  23-05-2021
  •  | 
  •  

Question

I recently (within the last month) lost an external Hard drive - it had years of photos on it and I am devastated. To try and jog my memory, I am trying to find a way to find out the last time I connected it to my MacBook. Is this possible in any way using the system.log files?

Thanks in advance

Was it helpful?

Solution

If your MacOS version is 10.12 and later, you can use the advanced terminal log tool.

here is how to do the same with it (if you prefer)

log show --last 35m --info --predicate 'eventMessage contains "mounted"'

here it will search for messages containing the word "mounted", but only messages of type INFO (you could change it for ERROR or omit the --info flag to search all messages)

You can change the time, on the example I used --last 35m which means only on the last 35 minutes, but you can use it like --last 4h to search the last four hours for your criteria.

Example output, click to expand it: enter image description here

If you know the service subsystem, you can filter just by it, like the example below (I created the example for timeMachine subsystem, for syntax demonstration)

log show --predicate 'subsystem == "com.apple.TimeMachine" AND eventMessage contains "Failed"'

Use additional parameters like last hours, select kind of message, redirect the output to a file, etc...

The log console is very powerful and it can make queries like a database tool.

It is faster if you use the query syntax like above, but for some quick searchs you can also use 'grep', like the example below:

log show --style syslog --last 15m --info |grep '\[USB\]'

Show USB connection of my iPhone on my MacBook on the last 15 minutes: (using GREP to filter messages) and output style syslog

enter image description here

Statistics about the log database can be retrieved with sudo log stats (picture below) showing the date of the oldest message, date of most recent, and various other information and statistics.

Statistics (the command may take a long time to generate it, (> 5min ~ 10min) enter image description here

How much data/days to store? How to customise:

  1. for [MacOS 10.12 Sierra or newer] )

    • Storage parameters (such how much days to keep messages) can be changed/customised with sudo log config

see sudo log config --help or man log

  1. for [MacOS El Capitan, Yosemite or older] )
    • Log settings (such as how much log data to keep stored) can be customised by editing /etc/asl.conf. Default parameters of 50MB on average gives about 7 days of stored logs.

/etc/asl.conf enter image description here

OTHER TIPS

You can look with /Applications/Utilities/Console. First you should figure out what messages will appear then you attach the drive. Once you know the message you can search for it.

You can find prior logs by scrolling down. I don't see the logs going back all that far. You need to search each file. You will find more info, if you know the name of the drive. This answer is based on Yosemite, 10.10.5.

enter image description here

Start console and place it so you can see it. Dismount drive if already mounted. You can either pull and re-attach connector or power-off and power-on. See what messages appear. You will see different messages for different device types.

For an external 4TB harddrive directly connect to my mac mini, here is what I saw.

enter image description here

For a flash drive attached to a usb hub, I found the message "getting new uuid:" in system.log[s].

enter image description here

There were mysterious error messages reported when I searched on a drive name. enter image description here

another way is to use grep in the terminal. The logs are in the folder "/private/var/log/system.log"

mac $ grep -ni -e "dosfat32" /private/var/log/system.log
1395:Aug  6 16:50:13 macLocal.local fseventsd[60]: could not open <</Volumes/DOSFAT32/.fseventsd/fseventsd-uuid>> (No such file or directory)
1396:Aug  6 16:50:13 macLocal.local fseventsd[60]: Failed to load UUID.  Removing all old log files in /Volumes/DOSFAT32/.fseventsd
1397:Aug  6 16:50:13 macLocal.local fseventsd[60]: log dir: /Volumes/DOSFAT32/.fseventsd getting new uuid: 6C3ACC63-0DD6-4ED6-9223-486DB3D22E8B
1408:Aug  6 16:53:57 macLocal.local fseventsd[60]: log dir: /Volumes/DOSFAT32/.fseventsd getting new uuid: 6D650AA2-14C2-4864-9BEB-9D5DD34A583F
Licensed under: CC-BY-SA with attribution
Not affiliated with apple.stackexchange
scroll top