Hi all,
I need to perform an investigation on a MacBook and I really don't know my way around them very well. My question is how do I get the system time from a MacBook Pro without having to log into the OS? I'm looking for something similar to entering BIOS on a PC.
Thanks in advance.
Greetings,
I thought I knew the answer, but apparently not. Here's what I do know.
Older Macs used Open Firmware. When you boot systems with OF, hold down Command-Option-O-F to get the OF prompt. On OS9 systems, the "time&date" command would show you the date. Under OSX, I think it is "decimal dev rtc" but I cannot test this to be certain.
The Mac Book Pros, which I am using at the moment, replaced OF with EFI. I've not been able to find a way to get into EFI on boot.
The best I could do was to boot into single user mode (Command S) and then issue the "date" command. But, that's not good enough.
I'll ask around and see if I can get a better answer for you.
Here's a website about Open Firmware
http//
Open Firmware command summary
http//
-David
Greetings,
Ok, the answer seems to be
- Download rEFIt from sourceforge - http//
- Put rEFIt on an external Firewire drive
- Boot that drive, and run rEFIt
It may be possible to install rEFIt on another Mac and boot the suspect machine in target Firewire mode and get to it that way. I don't have two Macs handy to try this out.
If you do try it out, could you post about what worked for you?
-David
Greetings,
Apparently, you can also make a boot CD with rEFIt on it and boot that without the HD installed.
-David
Thank you very much for your reply. You've given me some great information which I will try out and will post again with the results.
Thank you again kovar for your replies, they have been extremely helpful. My intention is to find a way to acquire the date/time of a Mac in the field so I went ahead and tested the CD image of rEFIt. These are the steps I took
- Download the ISO from http//
- The ISO is .cdr so you will need to burn the image using Mac via Disk Utility or a 3rd party burning tool.
- Reboot the MacBook Pro and hold down the Options button to bring up the boot menu
- Select “rEFIt “
- From the “rEFIt” menu select “Start EFI Shell”
- Once you’re at the CLI just type “date” and “time” to get the system date/time values
I navigated through the shell and, while it does see the hdd in the mac, it does not mount them by default and you cannot access them. While I still need to do more testing before using it in the field, this is by far the best option I have come across so far. Thanks again!