Do encrypted volumes contain any log telling when they were mounted and unmounted?
I have several encrypted USB thumb drives and I would like to know whether someone has tried to put them into their computer.
MacOS – Encrypted drive log of mounts/unmounts
adobe-flashapfsencryptionmacos
Best Answer
It's generally the practice that logs would be maintained on the system which is doing the mounting etc. On macOS the logs are typically located here:
/var/log/system.log.Matteo's answer here shows the various ways that mounting of devices or DMG image files will show up in this log after they're mounted/unmounted.