Finder Mounted Volume
Overview
Evidence: Finder Mounted Volume
Description: Collects the list of mounted volumes in Finder.
Category: DiskFilesystem
Platform: macos
Short Name: fmvlm
Is Parsed: Yes
Sent to Investigation Hub: Yes
Collect File(s): No
Background
Finder preferences track mounted volumes shown on the desktop. This data is essential for identifying external drives and volumes accessed by users.
Data Collected
This collector gathers structured data about finder mounted volume.
Finder Mounted Volume Data
| Field | Description | Example |
|---|---|---|
ID | ID | 123 |
Username | Username | Example value |
VolumeName | Volume Name | Example value |
Collection Method
This collector reads each user’s com.apple.finder.plist and extracts FXDesktopVolumePositions into finder_mounted_volumes.
Forensic Value
This evidence is crucial for forensic investigations as it indicates removable media usage and mounted volume names relevant to data movement.