Mac USB Device & External Storage Forensics

← Canonical HubThis page is part of the Mac Forensics cluster. Return to the hub for the full artifact index and cross-cluster context.

Quick Answer. Mac USB Forensics combines IOUSBFamily / IOUSBHost events in the Unified Log (subsystem com.apple.iokit.IOUSBFamily), diskarbitrationd mount records, com.apple.launchservices.secure.plist and com.apple.finder.plist volume tracking, per-user LSSharedFileList.RecentVolumes.sfl2, and FSEvents from /Volumes/<name>/.fseventsd/. Together they identify the device (vendor, product, serial), when it was connected, which user mounted it, and — critically — which files were written to or read from it.

IOUSB events in the Unified Log

Every USB attach and detach generates events under the com.apple.iokit.IOUSBFamily and com.apple.iokit.IOUSBHost subsystems. The event message includes the USB descriptor: idVendor, idProduct, bcdDevice, iSerialNumber, iManufacturer, and iProduct. The serial number is the same value burned into the device and matches the Windows USBSTOR SerialNumber value on the same device — cross-platform attribution is possible.

Baseline predicate: log show --predicate 'subsystem == "com.apple.iokit.IOUSBFamily" OR subsystem == "com.apple.iokit.IOUSBHost"' --info --debug

Mount records and volume attribution

Artifact	Path / source	What it establishes
diskarbitrationd	Unified Log subsystem com.apple.DiskArbitration	Volume UUID, filesystem type, mount point, mount user
fs_usage / diskimages	System Log	Disk image (DMG) attach events
LSSharedFileList.RecentVolumes.sfl2	~/Library/Application Support/com.apple.sharedfilelist/	Recently mounted volumes per user with resolved bookmarks
com.apple.finder.plist	~/Library/Preferences/	FXRecentFolders, sidebar entries including external volumes
spotlight-V100 on external	/Volumes//.Spotlight-V100/	Confirms indexed content — the volume was mounted and populated
External FSEvents	/Volumes//.fseventsd/	Full change history on the external volume itself

Proving files were copied to a USB device

Attribution of an exfiltration event follows a repeatable chain:

1. Device attach — Unified Log IOUSBFamily event with vendor/product/serial at time T.
2. Mount to /Volumes/<name> — DiskArbitration event confirms user session and volume UUID.
3. User activity during window — KnowledgeC.db /app/inFocus shows Finder or Terminal was frontmost.
4. Source-volume FSEvents — ItemInodeMetaMod read events on the source files (when auditing enabled) or Spotlight kMDItemLastUsedDate updates.
5. External-volume FSEvents — ItemCreated events for identical filenames on the external volume within the same second-precision window.
6. Extended attributes — com.apple.quarantine, com.apple.metadata:kMDItemWhereFroms, and com.apple.FinderInfo often propagate to the copy, preserving provenance.

Airdrop, iCloud, and non-USB exfiltration

Not all exfiltration goes over USB. In every USB matter we also review:

• AirDrop — com.apple.sharingd Unified Log entries showing incoming/outgoing transfers with peer device name and file names
• iCloud Drive — ~/Library/Mobile Documents/ FSEvents and cloud-doc metadata
• Dropbox / Google Drive / OneDrive — client-side databases and sync logs
• SMB / AFP mounts — LSSharedFileList.RecentServers.sfl2 and diskarbitrationd for network volumes

How Elite Digital Forensics helps

Elite Digital Forensics is an independent, defense-aligned Mac forensics practice. We are retained by attorneys, in-house counsel, and, where appropriate, individuals and businesses directly. Every engagement begins with a scoped acquisition plan, hash-verified evidence, and a written report suitable for attorney review, negotiation, or court. When retained through counsel, our work product is protected. See the Mac Forensics hub for the full analytical framework we bring to every matter.

Related Mac forensics pages

Frequently asked questions