I sometimes need to get some forensic information from Macs. One is this: I have a hard drive, SSD or flash storage that I removed from a mac and that has macOS installed, I then install it in another same mac or into an external enclosure so I can either start the mac from this storage or connect it to a USB port; can I get any information from that storage, such as from a log file, that would let me know in what mac the macOS was installed?, such as the serial number of the mac, or the MAC address (Physical address of the network card) or at least the Mac model of the Mac that was used to install the operating system?.
MacOS – know in what Mac macOS was installed for a given storage
macos
Related Question
- MacOS – Is it possible to know if a macOS startup drive has been used in another mac
- macOS – Where is the Serial Number of a Mac Located?
- MacOS – Create firmware partition for macOS to be installed
- MacOS Server – What is it Good For?
- MacBook SSD Issue – Fix Internal SSD Not Recognized
- MacOS – the expected durability of a Mac mini (2020) flash storage
- Select Disk for macOS Installation – How to Choose Correct Drive
Best Answer
You could take a look at /private/var/log/install.log. If you search for "MAC address" you'll find output from configd detailing the MAC addresses of the network interfaces on the Mac at the time.
Note: If you're doing any serious type of forensics, it is bad practice to boot up from the storage you're examining. Instead take a copy of the disk and examine that from a separate computer (either by mounting it read-only, or by booting up on a duplicate of the copied image).