How to know if a Ma...
Clear all

How to know if a MacBook pro has been restore ?

3 Posts
2 Users
Posts: 11
Active Member
Topic starter


I've got an dd_rescue image of a Macbook pro not encryped (macbook.raw), and I'd like to know if this Macbook pro (Mac OS X 10.13.5 17F77) has been restore. (And the date of this restore) , maybe with AXIOM Magnet forensic tool ?


Thank you

Posted : 27/08/2020 1:55 pm
Posts: 12
Active Member

Hi - Some areas that might be of benefit here:

$ /var/db/.AppleSetupDone

AppleSetupDone . This empty file is created after the completion of Setup Assistant. It doesn't exist on a brand-new, out-of-the-box Mac, nor on one that has had a clean installation of OS X. By removing this file, OS X will assume that Setup Assistant has never been run and will launch it as soon as OS X boots.

Cycle count may help.

$ system_profiler SPPowerDataType | grep "Cycle Count"

A low battery cycle count doesn’t necessarily mean that the computer has been rarely used if the owner has used it predominantly while connected to a power source. Additionally, the owner may have replaced their Mac’s battery so that’s another thing to factor in when buying a pre-owned Mac.

System Report > Software > Installations:

$ system_profiler SPInstallHistoryDataType



Posted : 28/09/2020 1:12 am
Posts: 11
Active Member
Topic starter

thank you !

Posted : 28/09/2020 10:18 am
Share to...