Hi
I've got an dd_rescue image of a Macbook pro not encryped (macbook.raw), and I'd like to know if this Macbook pro (Mac OS X 10.13.5 17F77) has been restore. (And the date of this restore) , maybe with AXIOM Magnet forensic tool ?
Â
Thank you
Hi - Some areas that might be of benefit here:
$ /var/db/.AppleSetupDone
AppleSetupDone . This empty file is created after the completion of Setup Assistant. It doesn't exist on a brand-new, out-of-the-box Mac, nor on one that has had a clean installation of OS X. By removing this file, OS X will assume that Setup Assistant has never been run and will launch it as soon as OS X boots.
Cycle count may help.
$ system_profiler SPPowerDataType | grep "Cycle Count"
A low battery cycle count doesn’t necessarily mean that the computer has been rarely used if the owner has used it predominantly while connected to a power source. Additionally, the owner may have replaced their Mac’s battery so that’s another thing to factor in when buying a pre-owned Mac.
System Report > Software > Installations:
$ system_profiler SPInstallHistoryDataType
Â
Â
thank you !