USB Entries on OS X

OS X does maintain historical data of media that has been utilized by the computer. It comes in the form of PLIST files and log file entries. Many questions arise from analysts that have looked at the Windows platform asking about the equivalent of a registry or registry key “USBSTOR”. There is no such key on OS X. PLISTs are the means of storing settings and this is where we can gather the historical data of connected media. This article can apply to Firewire connected devices as well as SATA/eSATA. It truly depends on which application or process is writing the PLIST or making the entry in the log file.

With that said, here are some of the common places to look for historical data:

Attached Media
  • /Users/username/Library/Preferences/com.apple.sidebarlists.plist - history of attached media, volumes devices, etc.

iPhone/iPod

  • /Library/Preferences/com.apple.iPod.plist - history of iPhone and iPod connectivity
  • /Users/“username”/Library/Preferences/com.apple.iPod.plist - history for this specific user

Log Files
  • system.log - always start here, this is the story of the Mac
  • kernel.log - 10.6 and 10.7 log USB connections, look for “kernel[0]: USBMSC Identifier” (Thank you Drew Fahey of BlackBag Technologies)
    • 10.8 moves this entry to system.log, no kernel.log exists for 10.8
  • DiscRecording.log - DVD/CD burning records
  • DiskUtility.log - initialized, secure erase, etc.
  • fsck_hfs.log - non-specific to USB/Firewire, but will give disk specific info