Is there a way to determine if your mac was booted of an external drive in the past?
MacBook Pro, Mac OS X (10.7.3)
No. Unfortunately, if it was booted from an external volume, only the logs on the volume it was booted from would have been updated. When you boot from an external volume, the external volume "is" the OS at that point. Anything on the internal volume is just seen as data (as though it were an external drive).
Thanks for the fast response!
Actually, is there anyway to prevent it?
You can set up a firmware password. It will pretty much lock down your system. Preventing booting from external volumes is just one of the things it can do. See this link for setting it up (I've pasted a summary below):
http://support.apple.com/kb/HT1352
| Features of Open Firmware Password Protection on PowerPC and Intel-based Mac computers | Power PC | Intel |
| Blocks the ability to use the "C" key to start up from an optical disc. | √ | √ |
| Blocks the ability to use the "D" key to start up from the Diagnostic volume of the Install DVD. | √ | |
| Blocks the ability to use the "N" key to start up from a NetBoot server. | √ | √ |
| Blocks the ability to use the "T" key to start up in Target Disk Mode (on computers that offer this feature). | √ | √ |
| Blocks the ability to start up in Verbose mode by pressing the Command-V key combination during startup. | √ | √ |
| Block the ability to start up a system in Single-user mode by pressing the Command-S key combination during startup. | √ | √ |
| Blocks a reset of Parameter RAM (PRAM) by pressing the Command-Option-P-R key combination during startup. | √ | √ |
| Requires the password to enter commands after starting up in Open Firmware, which is done by pressing the Command-Option-O-F key combination during startup. | √ | |
| Blocks the ability to start up in Safe Boot mode by pressing the Shift key during startup. | √ | √ |
| Requires the password to use the Startup Manager, accessed by pressing the Option key during startup (see below). | √ | √ |
Boot Records
