Thursday, November 19, 2015

#MacOS #DiskUtil not logging erase action in #ElCapitan #dfir

I have been doing testing with MacOS 10.11, El Capitan. Specifically I wanted to see if erasing a disk or disk partition using DiskUtil would leave a DiskUtil.log as it did in previous versions of MacOS. So far I have been unable to cause a DiskUtil.log to get created. I have read that DiskUtil has been rewritten as an ‘overhaul‘ in El Capitan.

Questions

Has anyone experience the same lack of logging? Has the log been moved/combined with another log? If the logging has been moved, where is it now located?

If you have answers let me know!

-Dave


by Dave via EasyMetaData