MacBook Pro System ...
 
Notifications
Clear all

MacBook Pro System Reset Artifacts

System_Update
(@system_update)
New Member

Hi all! Trying to determine the exact date that a Macbook Pro was reset.  We took a forensic image of the laptop using Digital Collector, but the APFS partition was encrypted, so the data we recovered is limited.  Any suggestions on specific artifacts are greatly appreciated.

I did a search for $ /var/db/.AppleSetupDone but did not see this artifact.

Quote
Topic starter Posted : 06/06/2022 4:20 pm
Share:
Share to...