Osx How to tell if ...
 
Notifications
Clear all

Osx How to tell if there was a password set

3 Posts
3 Users
0 Likes
954 Views
(@deltron)
Posts: 125
Estimable Member
Topic starter
 

Haven't been up to date with my mac forensic, right now I'm trying to tell if the user had a password enabled on the main account to log into or if there was no password protection allowing anyone to accesses the computer. Anyone know where to look for such information?

 
Posted : 27/01/2017 8:04 pm
(@arcus2005)
Posts: 11
Active Member
 

/Library/Preferences/com.apple.loginwindow.plist
autoLoginUse

This dont show you if the user have set a password or not, but it show if the user need to type password to login to OSX or if its just boots to desktop.

http//encase-forensic-blog.guidancesoftware.com/2013/07/examining-mac-os-x-user-system-keychains.html

 
Posted : 30/01/2017 2:01 pm
(@randomaccess)
Posts: 385
Reputable Member
 

pretty sure you always need a password on a mac, but as the previous poster said you can have it auto-login

otherwise information on extracting the password hashes can be found here

https://apple.stackexchange.com/questions/186893/os-x-10-9-where-are-password-hashes-stored

Otherwise easiest method is get a USB3 external and Xways, restore your image to the external and then option-boot into another mac. It should boot up into the restored drive just fine and youll have your answer

 
Posted : 30/01/2017 4:28 pm
Share: