MacBook Pro System ...
 
Notifications
Clear all

MacBook Pro System Reset Artifacts

1 Posts
1 Users
0 Reactions
2,070 Views
(@system_update)
New Member
Joined: 3 years ago
Posts: 1
Topic starter  

Hi all! Trying to determine the exact date that a Macbook Pro was reset.  We took a forensic image of the laptop using Digital Collector, but the APFS partition was encrypted, so the data we recovered is limited.  Any suggestions on specific artifacts are greatly appreciated.

I did a search for $ /var/db/.AppleSetupDone but did not see this artifact.


   
Quote
Share: