How to know if a Ma...
 
Notifications
Clear all

How to know if a MacBook pro has been restore ?

3 Posts
2 Users
0 Likes
2,152 Views
(@eilco)
Posts: 12
Eminent Member
Topic starter
 

Hi

I've got an dd_rescue image of a Macbook pro not encryped (macbook.raw), and I'd like to know if this Macbook pro (Mac OS X 10.13.5 17F77) has been restore. (And the date of this restore) , maybe with AXIOM Magnet forensic tool ?

 

Thank you

 
Posted : 27/08/2020 12:55 pm
(@mister4n6)
Posts: 12
Active Member
 

Hi - Some areas that might be of benefit here:

$ /var/db/.AppleSetupDone

AppleSetupDone . This empty file is created after the completion of Setup Assistant. It doesn't exist on a brand-new, out-of-the-box Mac, nor on one that has had a clean installation of OS X. By removing this file, OS X will assume that Setup Assistant has never been run and will launch it as soon as OS X boots.

Cycle count may help.

$ system_profiler SPPowerDataType | grep "Cycle Count"

A low battery cycle count doesn’t necessarily mean that the computer has been rarely used if the owner has used it predominantly while connected to a power source. Additionally, the owner may have replaced their Mac’s battery so that’s another thing to factor in when buying a pre-owned Mac.

System Report > Software > Installations:

$ system_profiler SPInstallHistoryDataType

 

 

 
Posted : 28/09/2020 12:12 am
(@eilco)
Posts: 12
Eminent Member
Topic starter
 

thank you !

 
Posted : 28/09/2020 9:18 am
Share: