Acquiring the computer time from a Mac is a common task for many investigators. Having the computer time allows and investigator to correlate computer events to actual time frames and may help secure a conviction.
Macs sold after March of 2001 will most likely have Mac OS X loaded on them and all Intel Macs run Mac OS X only. PowerPC Macs run Open Firmware from Sun. Intel Macs use EFI (Extensible Firmware Interface).
Determining if a firmware password is set
Before you can boot info Single User Mode, you must first determine if the user has set an firmware password on the system. An firmware password would prevent the investigator from booting into Single User Mode to determine the system's time and date. The firmware password can be reset but doing do also resets the system time also. To determine if there is an firmware password set, do the following:
- Power on the Mac while holding down the Option key.
- If you are presented with a screen showing the bootable partitions on the system then there is no firmware password set.
- If you are presented with a password screen then there is an firmware password and you will not be able to boot into Single User Mode.
- Once you have determined if there is an firmware password, power the Mac down by holding power button until the system powers off.
Finding the system date and time via Single User Mode
- Press the Power button and immediately hold down the Command (Apple) and S key. Doing so will make the Mac boot up in Single User Mode.
- Once booted into Single User Mode, you will see text across the top of the screen along with a command prompt. Type date and press the Enter key. The Mac will return the computer's current date and time along with the user configured time zone.
- You can then power down the computer safely.
Another option for finding the Mac's system time is to boot from the Mac OS X install CD/DVD. Once booted from the CD/DVD, select Terminal from the Utilities menu. In the Terminal type date and then press Enter. The system time and date will be shown. You may also boot from a Linux Live CD and get the system time using the terminal within Linux.
