Recovered MacBook Air turned on directly in Recovery mode : should I worry about compromised data ?

Question

Level 1

4 points

Recovered MacBook Air turned on directly in Recovery mode : should I worry about compromised data ?

Hello, everyone. I recently recovered my MacBook Air after I forgot it in a hotel room for about 2 nights. Miraculously it wasn't stolen or damaged. However, it was turned off (I remember just letting it in standby, cover closed) and when simply pressing the power button, it started up directly in Recovery Mode, showing the window for password change (forgotten, keyboard doesn't type, etc.)

What could have been done to it to start up in Recovery Mode like that ? Usually you need to press Command + Alt + power or something similar, not only the power button. Could the one(s) who played with it (instead of simply returning it to the front desk clerk...) have done something that compromised the security and data of my Macbook ? What should I do next ?

Thanks for your advice !

MacBook Air 13″, macOS 11.6

Posted on Oct 1, 2021 8:29 AM

Reply

Answer 1

Top-ranking reply

ChrisNick93 Author

Level 1

4 points

Oct 1, 2021 9:23 AM in response to KiltedTim

Indeed, chances are slim for them to have had access to the Mac if I found it in recovery mode... Otherwise I wouldn't have even recovered it in first place. Thanks a lot for your answer, it reassures me a lot !!!

Cheers !

Reply

Answer 2

KiltedTim

Level 10

203,638 points

Oct 1, 2021 8:34 AM in response to ChrisNick93

Assuming you used a password on your account and it would have been required on waking, I'd say the most likely scenario is that whoever found the laptop attempted to wipe it so they could reinstall macOS and steal it for themselves. Then, when running into the activation lock, they realized it was useless, and simply left it there.

It's unlikely they would have had any real interest in your data.

If they would not have required a password to get into the Mac, all bets are off.

Reply

Answer 3

Oct 1, 2021 12:07 PM in response to ChrisNick93

Hi ChrisNick93,

I don't think your Mac was erased. Instead, I think the following occurred:

On an Intel-based Mac, if FileVault is on and you're stuck at the first login screen, a message appears at the bottom of the screen, saying that if you need to reset your password, press and hold the power button until your Mac turns off. Then turn it on again.

I think someone forced your Mac to power off, and for some reason it decided to assume that you wanted to reset your password. As long as the same password as before works fine, you should be ok.

If you have any doubts about the integrity of your data and apps, you should erase your Mac and restore from a backup made before this incident.

EDIT: Very smart move for you to enable FileVault before this incident. It prevented attackers from gaining access to your data. The worst they could have done was to erase your data, which (I think) they didn't.

Reply

Recovered MacBook Air turned on directly in Recovery mode : should I worry about compromised data ?

Similar questions