±Forensic Focus Partners

Become an advertising partner

±Your Account


Username
Password

Forgotten password/username?

Site Members:

New Today: 0 Overall: 36317
New Yesterday: 0 Visitors: 133

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

±Latest Videos

±Latest Jobs

How can I find out dates of auto-logins set/disabled on Mac?

Computer forensics discussion. Please ensure that your post is not better suited to one of the forums below (if it is, please post it there instead!)
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
 
  

samsacksons
Newbie
 

How can I find out dates of auto-logins set/disabled on Mac?

Post Posted: Nov 18, 19 21:28

I want to know if the Mac was auto-login enabled during certain period. How can I Do that? If it is disabled now, I can’t assume it’s always been so..  
 
  

Igor_Michailov
Senior Member
 

Re: How can I find out dates of auto-logins set/disabled on

Post Posted: Nov 20, 19 05:27

Try to investigate the KnowledgeC database.
_________________
Computer, Cell Phone & Chip-Off Forensics

linkedin.com/in/igormikhaylovcf 
 
  

mjpetersen
Newbie
 

Re: How can I find out dates of auto-logins set/disabled on

Post Posted: Nov 20, 19 15:33

You may want to look over Sarah Edwards SANs presentation on Macintosh logs: digital-forensics.sans...h-logs.pdf

Really depends on which version of Mac you are looking at.  
 
  

dandaman_24
Senior Member
 

Re: How can I find out dates of auto-logins set/disabled on

Post Posted: Nov 20, 19 19:07

Sarah Edwards pdf listed above is a good source of information. Mounting the image in your Mac and using console to pull some logs from it would be a good idea. e.g. system.log

Also look in the following plists

com.apple.loginwindow.plist - info a about last logged on user

com.apple.preferences.accoubts.plist - keeps info on deleted user accounts, this will only be present if an account has been deleted.

Within the plists above, keep an eye out for guest profile, if the guest option is active a person could boot the Mac, login to guest without password, do some "naughty things" and log out.  
 
  

YogeshKhatri
Member
 

Re: How can I find out dates of auto-logins set/disabled on

Post Posted: Dec 02, 19 03:35

As pointed out, the autologin enable/disable setting is in this plist:
com.apple.loginwindow.plist

The password (its obfuscated version actually) is stored here:
/private/etc/kcpassword

I would also look at timestamps on that file, if it exists. And review logs of course.

My mac_apt tool (https://github.com/ydkhatri/mac_apt) will pull out all these files for you automatically when you run it on your evidence.
_________________
Yogesh Khatri

Blog - www.swiftforensics.com
Code - github.com/ydkhatri 
 

Page 1 of 1