Join Us!

Osx How to tell if ...
 
Notifications
Clear all

Osx How to tell if there was a password set  

  RSS
Deltron
(@deltron)
Active Member

Haven't been up to date with my mac forensic, right now I'm trying to tell if the user had a password enabled on the main account to log into or if there was no password protection allowing anyone to accesses the computer. Anyone know where to look for such information?

Quote
Posted : 27/01/2017 8:04 pm
Arcus2005
(@arcus2005)
New Member

/Library/Preferences/com.apple.loginwindow.plist
autoLoginUse

This dont show you if the user have set a password or not, but it show if the user need to type password to login to OSX or if its just boots to desktop.

http//encase-forensic-blog.guidancesoftware.com/2013/07/examining-mac-os-x-user-system-keychains.html

ReplyQuote
Posted : 30/01/2017 2:01 pm
randomaccess
(@randomaccess)
Active Member

pretty sure you always need a password on a mac, but as the previous poster said you can have it auto-login

otherwise information on extracting the password hashes can be found here

https://apple.stackexchange.com/questions/186893/os-x-10-9-where-are-password-hashes-stored

Otherwise easiest method is get a USB3 external and Xways, restore your image to the external and then option-boot into another mac. It should boot up into the restored drive just fine and youll have your answer

ReplyQuote
Posted : 30/01/2017 4:28 pm
Share: