3
2
We recently had an USB software dongle stolen from our studio containing very expensive software. If we can work out what date/time it was taken over the last 3 weeks, we can probably identify who did it. Does OS X keep logs of USB devices removed and if so, how can we access them?
willG
Posted 2013-06-28T14:15:47.047
Reputation: 31
3
This can be helpful but you have to use the terminal. We are going to look for the right dates in the system log file. After we found the first hit we continue investigate what USB identifier number it has.
First of all open terminal from spotlight or Applications/Utilities/Terminal.app
Switch to log directory by:
$ cd /var/log
Check current log file after the date before the device got stolen.
$ head system.log
If not the date or the time is correct continue analyze older files. First command gives you how many log files you have starting with the name "system". And after you found out how many files you have then you have to do same as before. Check if date is correct with an other command.
$ ls -a system*
$ bzcat system.log.xx.bz2 | head
After you have found out the right log files continue with checking the time.
OK, now you have found the right file for the correct date. Lets try to find a correct identifier number.
$ bzcat system.log.xx.bz2 | grep USBMSC
The output should be easy to understand like this one.
Jun 23 10:59:09 kernel[0]: USBMSC Identifier (non-unique): XXXXXXXXXXXXXXXXXXXXXX
If you think you have found the USB Identifier, make sure to control if it's the right one before you assume who stoled it.
Use the same command as before and try to find the same Identifier in newer log files by this command
$ bzcat system.log.xx.bz2 | grep XXXXXXX ( the usb identifier number )
You should not be able to find any results but probably in older files if you have used the USB device more than once.
Carl Abrahamsson
Posted 2013-06-28T14:15:47.047
Reputation: 177
This is the same question: http://www.mac-forums.com/forums/apple-desktops/117456-usb-activity-log.html . Depending on the software you are talking about you could maybe talk to the company and have them de-activate the key?
– user142485 – 2013-06-28T14:47:08.127Thanks. No they can't do it. The key is a Steinberg key called 'eLicense'. The software is Vienna Symphonic, costs a fortune and it looks like we're going to have to buy it all over again. – willG – 2013-06-28T14:54:15.327
Did you already look at this? https://www.steinberg.net/en/support/knowledgebase_new/show_details/kb_show/usb-elicensersteinberg-key-details-tips-and-troubleshooting.html#lk
– user142485 – 2013-06-28T15:05:39.047