Last command source file
Since Mac OS X 10.6 (Snow Leopard) Apple has replaced the utmp/wtmp mechanism with the Apple logging system. See man 5 utmpx for details.  Here is a pertinent excerpt:

Traditionally, separate files would be used to store the running log of the logins
and logouts (wtmpx), and the last login of each user (lastlogx).  With the avail-
ability of the Apple system log facility asl(3), these separate files can be
replace with log entries, which are automatically generated when utmpx entries are
written.  The API to access the logins and logouts is described in
endutxent_wtmp(3) while the last login info is accessible with getlastlogx(3).


See man asl for the programatic interface to the log system.  Apple Syslog saves all its utmp/wtmp/lastlog-like information in /var/log/asl/*.