A system includes a processor configured to determine if a vehicle computing system (VCS) has been placed in a monitoring mode. The processor is also configured to detect and log the connection or disconnection of any remote devices. The processor is further configured to flag logs if the VCS is in a monitoring mode. Also, the processor is configured to detect the presence of a known vehicle driver or the termination of the monitoring mode and report any flagged logs upon known driver detection or monitoring mode termination.