2

I sometimes need to get some forensic information from Macs. One is this: I have a hard drive, SSD or flash storage that I removed from a mac and that has macOS installed, I then install it in another same mac or into an external enclosure so I can either start the mac from this storage or connect it to a USB port; can I get any information from that storage, such as from a log file, that would let me know in what mac the macOS was installed?, such as the serial number of the mac, or the MAC address (Physical address of the network card) or at least the Mac model of the Mac that was used to install the operating system?.

2

You could take a look at /private/var/log/install.log. If you search for "MAC address" you'll find output from configd detailing the MAC addresses of the network interfaces on the Mac at the time.

Note: If you're doing any serious type of forensics, it is bad practice to boot up from the storage you're examining. Instead take a copy of the disk and examine that from a separate computer (either by mounting it read-only, or by booting up on a duplicate of the copied image).

  • Thanks for your answer. I couldn't find the MAC address there nor the serial number, but at least I found this useful bit: Hardware: Macmini7,1 @ 2.60 GHz (x 4), 8192 MB RAM. which somehow identifies the model that was used to install macOS.. – Antonio23249 Jul 6 '18 at 21:07

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .