Osx How to tell if there was a password set
Haven't been up to date with my mac forensic, right now I'm trying to tell if the user had a password enabled on the main account to log into or if there was no password protection allowing anyone to accesses the computer. Anyone know where to look for such information?
This dont show you if the user have set a password or not, but it show if the user need to type password to login to OSX or if its just boots to desktop.
pretty sure you always need a password on a mac, but as the previous poster said you can have it auto-login
otherwise information on extracting the password hashes can be found here
Otherwise easiest method is get a USB3 external and Xways, restore your image to the external and then option-boot into another mac. It should boot up into the restored drive just fine and youll have your answer