1

I need to know if the storage drive in a Mac (SSD/flash storage or hard drive), has been used on another machine (same model probably). How can I otherwise know if a file in this Mac or the use of an app has been done in this same Mac, or on another same mac started up after swapping the storage drive?

My idea is that this is not possible as during the boot nothing seems to be written to the startup drive. I know that the log-in can be found with Terminal (Last command), but how can I know this activity has been done in this mac or in another mac with this same storage?

Image added as part of answer by Jaume: enter image description here

  • Why do you need to know if what business problem are you looking to solve? – Mark Jul 29 '18 at 0:12
1

I need to know if the storage drive in a Mac (SSD/flash storage or hard drive), has been used on another machine (same model probably).

macOS logs the computer's MAC addresses in these files: /var/log/daily.out and /var/log/wifi.log.

Since a MAC address (MAC stands in this context for media access control) is unique to every network interface and thus different on every Mac, you can list the current computer's MAC addresses and check if they differ from what has been logged:

  1. Launch the Terminal app, located in /Applications/Utilities.
  2. Run:

    ifconfig | grep -A 2 '^en' | grep ether | sed 's/\(.*\)\(..:..:..:..:..:..\)/\2/'
    

    to list all physical MAC addresses on your Mac.

    Output will be similar to this:

    60:f8:11:8f:f0:00
    e0:f8:43:42:6d:40
    d2:00:11:8f:f0:00
    
  3. Now run:

    sudo grep 'initWithInterfaceAndIE: _myMacAddress' /var/log/wifi.log | sed 's/\(.*\)\(..:..:..:..:..:..\)/\2/' | sort | uniq
    

    to list all logged physical MAC adresses.

    Output will be similar to this:

    60:f8:11:8f:f0:00
    
  4. Compare the output of ifconfig with the logged MAC addresses.

    If a MAC address listed in step 3 is not included in the list from step 2, it is very probable that the internal storage has been used with another Mac.

  • Thanks for your answer. I just tried and the result was a bit puzzling, please check the attached picture in my original post. The highlighted MAC addresses don't appear in the ipconfig command. – Antonio23249 Aug 8 '18 at 23:22
  • I never used its flash storage in another mac – Antonio23249 Aug 9 '18 at 10:51
  • I've find out that the grep commands I wrote in step 3 don't work properly for some configurations (and that's why one of the results in your screenshot is unusable). I've written a new grep command and have tested it on two different Macs, I hope it works for you now. You can then proceed with step 4: check whether a MAC address listed in step 3 is not included in the list from step 2, that would be a sign that the internal storage has been used elsewhere. – jaume Aug 9 '18 at 19:44
  • @Antonio23249 Have you had a chance to test the procedure I describe in my answer? I modified the last step, now it should work. I'd appreciate it if you could provide some feedback on it or, if it answers you question, mark it as the accepted answer. – jaume Aug 21 '18 at 12:08
  • Seems to be working fine!. I need to test it properly. Thanks again Jaume for your help, sorry again I'm taking long to answer. This is very useful. – Antonio23249 Aug 25 '18 at 23:08

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .