The short answer
macOS shows only the USB devices connected right now, in System Information → USB or with system_profiler SPUSBDataType SPUSBHostDataType. It keeps no list of devices connected earlier. The unified log records when a disk was mounted, but hides which one as “<private>”. To see every device that connects from now on, a logger has to be running first.
On this page
See what's connected right now
- Hold the Option key and choose Apple menu → System Information.
- Under Hardware, select USB. Devices are listed under the bus and any hub they connect through.
- Select Thunderbolt/USB4 for Thunderbolt devices and docks.
- After you plug something in or out, choose File → Refresh Information.
system_profiler SPUSBDataType SPUSBHostDataTypesystem_profiler SPThunderboltDataTypeEach device shows its name, maker, serial number where it has one, and the speed it connected at. The USB cable speed guide explains that speed line.
Why there's no USB history
Both lists describe the moment you open them. Unplug a device and it's gone from the list, with no record that it was there. macOS has no screen or setting that lists devices connected in the past.
The unified log is the closest thing. Disk Arbitration, the part of macOS that mounts disks, writes a line each time a disk is mounted:
log show --last 2d --style compact --predicate 'process == "diskarbitrationd" AND eventMessage CONTAINS[c] "mounted"'2026-10-25 09:55:58 diskarbitrationd: mounted disk, id = <private>, success.
2026-10-25 10:03:07 diskarbitrationd: unmounted disk, id = <private>, success.- It gives times, not names. macOS hides the disk's identity as
<private>, so you can't tell a USB drive from a disk image you opened. - It only covers disks. Keyboards, mice, phones and hubs don't mount anything.
- It doesn't last. The unified log is kept for a limited time, so older entries are gone.
Kernel messages about USB ports are in the log too, but on our test Mac they described ports and power states, not the devices plugged into them.
What macOS can do: ask before a new accessory connects
On Mac laptops with Apple silicon, Apple says you might need to approve new accessories before they can connect. The setting is in System Settings → Privacy & Security → Accessories, next to “Allow accessories to connect”, with four choices: Always ask, Ask for new accessories (the default), Automatically allow when unlocked, and Always allow.
If your Mac is locked, you need to unlock it before you can allow an accessory. That stops a device from connecting unnoticed, but it doesn't keep a record of what was plugged in, or tell you that something tried while you were away.
Why a new keyboard matters
Some devices that look like a USB drive also present themselves to the Mac as a keyboard, and can type commands the moment they're connected. A keyboard you didn't plug in, or a “drive” that is also a keyboard, is the one device worth an immediate look.
- Unplug anything you don't recognise.
- In System Information → USB, check what's connected now, and look for a keyboard you don't own.
- Set “Allow accessories to connect” to Ask for new accessories or Always ask, if your Mac has it.
The faster way: the USB log in iKnowMyMac
iKnowMyMac's USB log records every USB and Thunderbolt device that connects to your Mac, with time, name and what it is, including while the Mac is locked or at the login window. It starts logging the day you install it; nothing before that can be recovered. Filters show what came While away, Keyboards and This week.
USB Log
Every device that connected to this Mac · kept on this Mac
USB Keyboard · if it isn't yours, unplug it
- While you were away. Unknown devices connected while your Mac was locked, at the login window, or idle for 5 minutes, as one summary when you're back: “While you were away: 2 unknown devices connected”, with the first and last time.
- New keyboard alert. “A new keyboard was just connected”, within a second, with the device's name: “never seen before. If you didn't plug in a keyboard, unplug it now.”
- It stays on your Mac. The USB log records device names and IDs, never file contents.