How to know if a Ma...
 
Notifications
Clear all

How to know if a MacBook pro has been restore ?  

  RSS
eilco
(@eilco)
New Member

Hi

I've got an dd_rescue image of a Macbook pro not encryped (macbook.raw), and I'd like to know if this Macbook pro (Mac OS X 10.13.5 17F77) has been restore. (And the date of this restore) , maybe with AXIOM Magnet forensic tool ?

 

Thank you

Quote
Posted : 27/08/2020 1:55 pm
Mister4n6
(@mister4n6)
New Member

Hi - Some areas that might be of benefit here:

$ /var/db/.AppleSetupDone

AppleSetupDone . This empty file is created after the completion of Setup Assistant. It doesn't exist on a brand-new, out-of-the-box Mac, nor on one that has had a clean installation of OS X. By removing this file, OS X will assume that Setup Assistant has never been run and will launch it as soon as OS X boots.

Cycle count may help.

$ system_profiler SPPowerDataType | grep "Cycle Count"

A low battery cycle count doesn’t necessarily mean that the computer has been rarely used if the owner has used it predominantly while connected to a power source. Additionally, the owner may have replaced their Mac’s battery so that’s another thing to factor in when buying a pre-owned Mac.

System Report > Software > Installations:

$ system_profiler SPInstallHistoryDataType

 

 

ReplyQuote
Posted : 28/09/2020 1:12 am
eilco
(@eilco)
New Member

thank you !

ReplyQuote
Posted : 28/09/2020 10:18 am
Share: