MacBook Pro System ...
 
Notifications
Clear all

MacBook Pro System Reset Artifacts

1 Posts
1 Users
0 Reactions
1,747 Views
(@system_update)
Posts: 1
New Member
Topic starter
 

Hi all! Trying to determine the exact date that a Macbook Pro was reset.  We took a forensic image of the laptop using Digital Collector, but the APFS partition was encrypted, so the data we recovered is limited.  Any suggestions on specific artifacts are greatly appreciated.

I did a search for $ /var/db/.AppleSetupDone but did not see this artifact.

 
Posted : 06/06/2022 4:20 pm
Share: