Filevault (or fdesetup ?) Logs - looking for dates on local mac of when encrypted or decrypted

[prograham]

Hi, anyone know if the Mac stores locally a log of dates when filevault was enabled and/or disabled? Trying to figure out if a user decrypted mac on their own or if it was issued unencrypted.

Thanks.