Notifications
Clear all
General (Technical, Procedural, Software, Hardware etc.)
1
Posts
1
Users
0
Likes
1,672
Views
Topic starter
Hi all! Trying to determine the exact date that a Macbook Pro was reset. We took a forensic image of the laptop using Digital Collector, but the APFS partition was encrypted, so the data we recovered is limited. Any suggestions on specific artifacts are greatly appreciated.
I did a search for $ /var/db/.AppleSetupDone but did not see this artifact.
Posted : 06/06/2022 4:20 pm
