Basic Concepts into macOS (part 1)

Basic Concepts into macOS (part 1)

In today's writings I am seeking your response to a theory about the file called .AppleSetupDone which is located in the /Private/var/db folder. The question is do you think, the Created Date is when the first time the OS was installed on the system (no fresh installs here) or something else? The second question is the Added Date, do you think this represents the last update of whatever version of OS you have on your system?

I have some theories that I will post later but wanted to hear from those who has also done some research in this area.

Raymond A.

Analyzing Digital Fingerprints…

5 个月

Last I recall, when analyzing a Mac, we knew the device had been wiped and reinitalized, the timestamp on the .AppleSetupDone corresponded with the reinstall date.

回复

要查看或添加评论,请登录

社区洞察

其他会员也浏览了