#MacOS #DiskUtil not logging erase action in #ElCapitan #dfir

I have been doing testing with MacOS 10.11, El Capitan. Specifically I wanted to see if erasing a disk or disk partition using DiskUtil would leave a DiskUtil.log as it did in previous versions of MacOS. So far I have been unable to cause a DiskUtil.log to get created. I have read that DiskUtil has been rewritten as an ‘overhaul‘ in El Capitan.


Has anyone experience the same lack of logging? Has the log been moved/combined with another log? If the logging has been moved, where is it now located?

If you have answers let me know!



About the author

-Blog my research related to metadata, digital forensics and other technical topics.
-Develop software solutions for EasyMetaData.com
-Licensed Computer Forensics Investigator for G-C Partners
-World Traveler!