Haven't been up to date with my mac forensic, right now I'm trying to tell if the user had a password enabled on the main account to log into or if there was no password protection allowing anyone to accesses the computer. Anyone know where to look for such information?
/Library/Preferences/com.apple.loginwindow.plist
autoLoginUse
This dont show you if the user have set a password or not, but it show if the user need to type password to login to OSX or if its just boots to desktop.
http//
pretty sure you always need a password on a mac, but as the previous poster said you can have it auto-login
otherwise information on extracting the password hashes can be found here
https://
Otherwise easiest method is get a USB3 external and Xways, restore your image to the external and then option-boot into another mac. It should boot up into the restored drive just fine and youll have your answer