Hi Everyone,
I have a case of a stolen Macbook Pro. The victim has an external HD with multiple Timemachine backups which I have available to me. Is there a plist (or other file) that would be in the backup that would have the hardware address of the laptop? Then we'd be able to locate where it connects to the network…
I tried looking in multiple airport and network settings/configuration plists, but only found hardware addresses for routers the computer connected to, rather than the actual device. A simple content search using Finder displayed no results either. Any ideas?
This link should help you..
http//
Greetings,
The MAC address of the system only shows up on the local net. You will not see it appearing anywhere beyond the local firewall or router.
/var/log/kernel.log should have local IP and MAC address information in it.
-David
Thanks for the information. Unfortunately, the TimeMachine backup looks similar to the root of the startup disk (broken into folders like Applications, Library, Resources, System, and Users) so I'm having trouble driving through there to find the information I need. Finder is failing when doing searches (for content or file names) so I have to find this information manually. I've tried scrolling through and haven't had any luck. So is it true then that there is no way for me to find the local hardware address with a time machine back up?
The link that tmanolo posted contains info on how to obtain the MAC address from the command line, but assumes you know the computer name.
Haven't checked on OS X 10.7, but with 10.5 and, IIRC, 10.6 as well, the /var/log directory is excluded from Time Machine backups. See for instance http//
Note also that the Finder hides certain files and folders, so even if Time Machine *had* backed up /var/log, you'd have to use the command line or the Finder's Go To Folder option to get to it.