metapree

Q: Boot Records

Is there a way to determine if your mac was booted of an external drive in the past?

MacBook Pro, Mac OS X (10.7.3)

Posted on Apr 10, 2012 4:56 AM

Close

Q: Boot Records

  • All replies
  • Helpful answers

  • by JoeyR,Helpful

    JoeyR JoeyR Apr 10, 2012 5:27 AM in response to metapree
    Level 6 (8,280 points)
    Apr 10, 2012 5:27 AM in response to metapree

    No.  Unfortunately, if it was booted from an external volume, only the logs on the volume it was booted from would have been updated.  When you boot from an external volume, the external volume "is" the OS at that point.  Anything on the internal volume is just seen as data (as though it were an external drive). 

  • by metapree,

    metapree metapree Apr 10, 2012 5:46 AM in response to JoeyR
    Level 1 (0 points)
    Apr 10, 2012 5:46 AM in response to JoeyR

    Thanks for the fast response!

  • by metapree,

    metapree metapree Apr 10, 2012 5:47 AM in response to metapree
    Level 1 (0 points)
    Apr 10, 2012 5:47 AM in response to metapree

    Actually, is there anyway to prevent it?

  • by JoeyR,

    JoeyR JoeyR Apr 10, 2012 6:08 AM in response to metapree
    Level 6 (8,280 points)
    Apr 10, 2012 6:08 AM in response to metapree

    You can set up a firmware password.  It will pretty much lock down your system.  Preventing booting from external volumes is just one of the things it can do.  See this link for setting it up (I've pasted a summary below):

     

    http://support.apple.com/kb/HT1352

     

    /___sbsstatic___/migration-images/180/18090154-1.jpg

    Features of Open Firmware Password Protection on PowerPC and Intel-based Mac computersPower PCIntel
    Blocks the ability to use the "C" key to start up from an optical disc.
    Blocks the ability to use the "D" key to start up from the Diagnostic volume of the Install DVD.
    Blocks the ability to use the "N" key to start up from a NetBoot server.
    Blocks the ability to use the "T" key to start up in Target Disk Mode (on computers that offer this feature).
    Blocks the ability to start up in Verbose mode by pressing the Command-V key combination during startup.
    Block the ability to start up a system in Single-user mode by pressing the Command-S key combination during startup.
    Blocks a reset of Parameter RAM (PRAM) by pressing the Command-Option-P-R key combination during startup.
    Requires the password to enter commands after starting up in Open Firmware, which is done by pressing the Command-Option-O-F key combination during startup.
    Blocks the ability to start up in Safe Boot mode by pressing the Shift key during startup.
    Requires the password to use the Startup Manager, accessed by pressing the Option key during startup (see below).