±Forensic Focus Partners

Become an advertising partner

±Your Account


Username
Password

Forgotten password/username?

Site Members:

New Today: 0 Overall: 36312
New Yesterday: 7 Visitors: 139

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

±Latest Videos

±Latest Jobs

Osx How to tell if there was a password set

Computer forensics discussion. Please ensure that your post is not better suited to one of the forums below (if it is, please post it there instead!)
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
 
  

Deltron
Senior Member
 

Osx How to tell if there was a password set

Post Posted: Jan 27, 17 20:04

Haven't been up to date with my mac forensic, right now I'm trying to tell if the user had a password enabled on the main account to log into or if there was no password protection allowing anyone to accesses the computer. Anyone know where to look for such information?  
 
  

Arcus2005
Member
 

Re: Osx How to tell if there was a password set

Post Posted: Jan 30, 17 14:01

/Library/Preferences/com.apple.loginwindow.plist
autoLoginUse

This dont show you if the user have set a password or not, but it show if the user need to type password to login to OSX or if its just boots to desktop.

encase-forensic-blog.g...hains.html  
 
  

randomaccess
Senior Member
 

Re: Osx How to tell if there was a password set

Post Posted: Jan 30, 17 16:28

pretty sure you always need a password on a mac, but as the previous poster said you can have it auto-login

otherwise information on extracting the password hashes can be found here

apple.stackexchange.co...hes-stored

Otherwise easiest method is get a USB3 external and Xways, restore your image to the external and then option-boot into another mac. It should boot up into the restored drive just fine and youll have your answer  
 

Page 1 of 1