Any Mac experts around please?

~Chameleon~

Posting on behalf of a friend who had their Macbook stolen last night to hopefully find out if there's any way of tracing it (if someone else tries to use it) or blocking it completely via the internet?

Apparently it's password protected but has sensitive and confidential files on it so she's worried about someone accessing them. Is there any possibility someone could hack into it?

I don't have a clue as I'm a PC user, always have been, and my friend has only recently started using a Macbook so isn't yet competely au fait with how the security works.

Any advice I can pass on to her please?

Marty_J

Ouch!

No, there's no way of tracing it, apart from reporting it to the police and hoping it turns up. I really hope it was insured.

As for her files, whether or not someone will be able to access them depends. If she was using File Vault, they'll be encrypted, and will be very difficult for the average person to access. If she wasn't using File Vault, there is a way to reset the administrator password and then possibly access her files, but it involves using the command line and is beyond most people's knowledge. Most people have never used a Mac never mind its command line, so I think its unlikely they'll be able to get to her stuff.

Even so, she should be changing her passwords and possibly contacting her bank if she had any banking details stored on there. It's better to be safe than sorry.

~Chameleon~

Thanks for your help. It's been reported to the police but they hold out little hope of ever finding it as she didn't have it security marked with post code.

It was me that suggested to her that they might be able to trace it via the internet as when I first ever connected my iPhone to iTunes it told me what my serial number etc was and registered it online for me. Does the same not apply to Mac's?

I'll mention the File Vault thing to her (means nothing to me lol) later and fingers crossed she used it.

Marty_J

No, Apple don't track the serial number of Macs (or iPhones for that matter).

If the police have the serial number, they should get in touch with her if they ever recover it. She might try keeping an eye on eBay or her local classified listings. It's possible whoever stole it might try and sell it.

Sometimes, stolen Macs do turn up though:

http://www.news.com.au/technology/story/0,25642,23684532-5014111,00.html

Leopard

Ouch, indeed.

Assuming that she has a record of its Serial # (and, hopefully, that she also registered it with Apple) she should, in addition to reporting it to the police, report its theft immediately to Apple, who will enter this in their registry. If anyone then takes it to an Apple Retail Store or an Apple dealer at any time - perhaps because they've "accidentally locked themselves out of it" - they will pick this up and discreetly summon the police.

It's better to keep confidential files on a remote server to which one has secure access than to store them on a laptop that can be stolen.

In the meantime, change all passwords and, where possible, User Names at online sites and inform all banks and credit card companies with which she holds accounts. Also all ISPs whose cellphone network she may have accessed to use her mobile 'phone as a modem for her MacBook.

Be aware that even if the MacBook is password protected, its hard drive can be removed or even just accessed via Firewire using a method that I'm not going to post publicly on here. :cool:

~Chameleon~

Thanks to both of you for your advice. I've printed off your replies to give to her as it's easier than me trying to remember it all. Maybe she should have stuck to a PC after all lol


Leopard - I'm assuming that it would only be of use to someone who "knows what they're doing" with Macs? Obviously don't post here how they would do it, don't want to go giving these scumbags who steal them any ideas!!!!

Thanks again guys :beer:

~Chameleon~

Marty_J wrote: »

No, Apple don't track the serial number of Macs (or iPhones for that matter).

If the police have the serial number, they should get in touch with her if they ever recover it. She might try keeping an eye on eBay or her local classified listings. It's possible whoever stole it might try and sell it.

Sometimes, stolen Macs do turn up though:

http://www.news.com.au/technology/story/0,25642,23684532-5014111,00.html

Hahaha just read that story ... excellent!!!!!! :rotfl:

How ingenious is that!

Leopard

Sadly, though, it's unlikely she set up Back to My Mac if she was new to the Apple platform.

But at least if it's insured she might get a brand new MacBook out of it.

Which would help to soften the the pain of the trauma she has suffered.

I'm sure she has Marty J's sympathy as well as yours and mine.

These things happen and the honest suffer from the innocence of not being a thief oneself, nor thinking like one.

Must have been a horrible experience.

timbim_2

Leopard wrote: »

Be aware that even if the MacBook is password protected, its hard drive can be removed or even just accessed via Firewire using a method that I'm not going to post publicly on here. :cool:

Would that be target mode? You or Marty explained that to me in the thread we had a while back relating to the uses of firewire. Not a closely guarded secret, obviously.;)

BikerEd

Other than physical security precautions which you should use to ensure you Mac doesn't get stolen in the first place, there are many ways to protect your Mac proactively, many of which help you locate your Mac should it be stolen and even use the iSight camera to see who is using your stolen Mac.

Undercover 3 - http://www.orbicule.com/undercover/mac/

Back to my Mac (part of MobileMe) - http://www.informationweek.com/news/security/client/showArticle.jhtml?articleID=207602622

Any number of free and shareware anti-theft apps - http://www.macupdate.com/search.php?keywords=theft&os=mac

~Chameleon~

Thanks, I'm sure those will be very useful to her if/when she gets a new one. I think she's still waiting to hear from the insurance company to find out whether it was actually covered away from home.


ETA: but surely none of those methods would be of any use in tracking it down if, as suggested above, they simply replace the HD?