MacBook Pro System ...
Clear all

MacBook Pro System Reset Artifacts

1 Posts
1 Users
0 Reactions
Posts: 1
New Member
Topic starter

Hi all! Trying to determine the exact date that a Macbook Pro was reset.  We took a forensic image of the laptop using Digital Collector, but the APFS partition was encrypted, so the data we recovered is limited.  Any suggestions on specific artifacts are greatly appreciated.

I did a search for $ /var/db/.AppleSetupDone but did not see this artifact.

Posted : 06/06/2022 4:20 pm