Currently Being ModeratedDec 8, 2013 12:56 PM (in response to Doc. Caliban)
No. How would they do that if they have to connect the drive to your computer? If it's a concern, then don't leave the computer unattended without locking it with a password that's required for access.
Currently Being ModeratedDec 8, 2013 1:19 PM (in response to Kappy)
Thank you for the reply. The circumstances are irrelevant, which is why they are not factored into the question; I am wondering from a purely nuts and bolts technical standpoint.
I'm assuimg then that there is no way that anyone, regardless of technical prowess, would be able to tell if an external drive was used to boot a Mac?
Currently Being ModeratedDec 8, 2013 2:45 PM (in response to Doc. Caliban)
You could use the Console and search the system.log and system.log.0.gz etc for the string 'BOOT_TIME'
This would tell you when the system was booted up and from what drive.
You could also search for the string 'mount' and that would give any disks that have been mounted and I would expect that to include external drives as well.
Don't include the quotes when you enter the string in the search bar.
Of course if the person doing this was trying to evade detection they could delete the logs.
Currently Being ModeratedDec 8, 2013 6:03 PM (in response to Doc. Caliban)
Open Console in the Utilitiy folder. Select All Messages on the left. Enter "boot_time" in the search field (omit quotes.) You should get something like this which is from Mavericks:
12/7/13 12:20:03.000 PM bootlog: BOOT_TIME 1386436803 0
12/8/13 1:11:57.000 PM bootlog: BOOT_TIME 1386526317 0
If there is anything meaningful then you can use it.Mac Pro, OS X Mavericks (10.9), iMacs, MBPs, MBs, iPods, iPads, ATV
Currently Being ModeratedDec 9, 2013 12:49 PM (in response to Doc. Caliban)
Kappy & rack0 tack0,
Thanks again for the responses ... this is along the lines of what I was looking for.
1. My understanding is that the Boot ROM does the POST and then the EFI portion selects which installed OS to access, and that is where I thought the Option key comes into play; giving the user the option of which drive to boot from instead of the EFI defaulting to the last used, and at this point the drives are just coming into play.
Based on that assumption, I thought that any system logging would be done solely on the drive which is being booted from. If this is the case, then I'd think that booting from the ineternal drive and then checking the log files would result in no entries related to having booted from an external drive. Is this incorrect? I certainly do not know for sure ... again, this is simply an assumption on my part.
TL;DR Is the boot activity logged by the ineranal drive no matter what, or will those log entries only appear on the drive being booted from?
2. When I open Console, select All Messages, and type boot_time in the search box, I get no results. What am I doing incorrectly?
Thanks agian for your time!
Currently Being ModeratedDec 9, 2013 12:58 PM (in response to Doc. Caliban)
Thinking about it again you are correct, the log files will be on the external drive.
In that case I am not sure how to detect it.
It Is BOOT_TIME in capitals.
Currently Being ModeratedDec 9, 2013 1:30 PM (in response to Doc. Caliban)
Ah, I should have mentioned that I'd tried both BOOT_TIME and boot_time. I am currently booted from a USB drive and am coming up empty on either query.
In the end it is ok if booting from an external is not detectable. I am only wondering from a geek standpoint as I have a background in security and the question came to mind after I first booted from the external. (MPB is down at the moment, so I put it's drive in an enclosure and booted from it on the iMac.)
I appreciate all of the feedback.
Currently Being ModeratedDec 9, 2013 1:52 PM (in response to Doc. Caliban)
Not sure why it does not show up. I am running on an external drive now, it is a backup clone and it shows it in this system.log, attached screen shot. I have used system.log instead of all messages due to it being a clone it shows all the BOOT_TIME values of the internal disk when I cloned it. This screen shot is from the boot up just now on the External drive. Not overly clear but I think you will be able to read it.
Currently Being ModeratedDec 9, 2013 3:17 PM (in response to rack0 tack0)
I booted from the internal drive and was able to find the log entry, then booted from the external again and was able to find it. I'm not sure what was going on when I was trying originally, but I'm certain that I was doing the search the same way both times.
Either way, it seems to be behaving as expected now.
This has given me an idea though: When my GF and I travel, I lug the MBP along so I have access to my files, and she brings her MBA. I'd be just as happy to leave the SSD from the MBP in the external housing and boot her MBA from it on the road when I need to use "my" computer, and boot it from the iMac when I'm at home. Maybe I don't need the MBP at all ... I'll have to think about that. The only other place I travel to is my mom's, and she has an iMac I could boot from as well. I have an iPad Mini that I can use in a pinch.
Currently Being ModeratedDec 9, 2013 3:43 PM (in response to Doc. Caliban)
Not sure about that, the machines will have different hardware and it is possible that the external drive setup on your MBP will not behave correctly on different hardware.
Still as long as the external drive is just a backup of your MBP and you have similar backup for the MacBook Air and iMac you could try it it.
On the other hand if you setup the external drive on the MacBook Air with all your data then yes you could use the Air with your ext drive.
Then again you could just have two accounts on the Air.
Give you something to think about.
Hope you sort it all out as you require.
Currently Being ModeratedDec 10, 2013 2:58 PM (in response to rack0 tack0)
I tested it between the iMac and the late 2011 MBA and it seems to work well. I saw something in Apple's KB about the main issue being that the hardware needs to be something that the installed version of OS X supports, so booting newer hardware with older versions is the potential challenge. 10.9 should run on all of the sytems I'd try it with, so I'll see how it is to live this way for a while before I decied.
First world challenges, and all that.