Become a MacRumors Supporter for $50/year with no ads, ability to filter front page stories, and private forums.
Status
Not open for further replies.

XJ-Tim

macrumors newbie
Mar 17, 2012
10
0
very useful info, however, I'm working on a preowned laptop which was likely stolen because "find my mac" message popped up and the computer locked. I was in the middle of wiping the hard drive and reinstalling OSX. so, with the HDD already wiped clean, will the file with the numbers still be there?
 

ExciteWalk

macrumors member
Original poster
Sep 11, 2012
46
7
@XJ-Tim, use something like Stellar Mac Data Recovery to see if it can recover the file.
 

ronmathews

macrumors newbie
Nov 2, 2012
15
0
clone

i been sitting on this for days iam able to see a some of the files using transmac.. but this is what i have done so far . i cloned the original ssd on the macbook pro, to a smaller 80 gb hitachi drive and another clone to a 8 gb memory card.. i mount the memory card and able to read all the 3 partitions efi,macintosh hd and recovery hd.. things i have tried booting from x 86 iatkos l2 and iatjos s3 didnt work.. used another hard drive witrh lion,mountain lion and snow leopard instalations didnt work.. kept the efi and the recovery partition on the cloned drive intact and restored just the macintosh hd partition with a working install didnt work swapped the efi partition with snowleopard install usb efi didnt work.. i got some patience to work on it if you guys need to me to look for any specific file i can look and post a screen shot and also iam just a regular mac user no power user and mostly windows user ..
 

johnnyboy200

macrumors newbie
Nov 6, 2012
10
1
whats this 4 digit number located at Library\Server\Mail\Data\mta in this file: master.lock ?

Any good?
 

ExciteWalk

macrumors member
Original poster
Sep 11, 2012
46
7
@ron, let me get back to you once I get on my desktop.

@Johnny, can you send me the file via Dropbox or something?
 

Nobann

macrumors newbie
Nov 8, 2012
3
0
I've just removed hd since there is no better things to do . Crossing fingers and waiting for a pc to mount it i'll post feedback if it works. I jeard about removing some file called applesetupdone. Will this help with that case?
 

AppleMacFinder

macrumors 6502a
Dec 7, 2009
796
152
1. Alternate machine with space to mount an additional drive. (works on Mac or PC*)
*If you're using a PC, you'll need to download and install Mac Drive to be able to read the contents from a Windows environment.
2. You might need a SATA to USB adapter if you have a laptop without room for an additional drive.
3. Screw driver to disassemble the Mac.

Once, there was some weird glitch with my iCloud account, and my Mac was locked without any reason.
The PIN code consists just of 4 numbers (10000 values total), so I solved this problem with stupid Bruteforce method.
Spent several hours on that, because every 5 tries, you need to reboot your Mac to reset the "waiting" counter,
and reboot takes almost 1 minute. Was not bored at all: there was a PC near me and I used it for Internet browsing.

But, after this situation, I am really worried about this feature: since the real thief could do the same thing as me
and unlock the Mac in less than one day, then this feature does not bring any security at all! :mad:
Should be more numbers, or letters as well - otherwise, it just too easy!
 

imaam7700

macrumors newbie
Nov 8, 2012
3
0
i tried all the numbers
but it didn't work
so i wanna ask a question
I can do without my files, i can start from beginning with my mac
the question is : what if i formatted my hard ?? is it will help me ??

i wanna format my hard and install mac os xlion from the beginning with its dvd

can i ???
 

johnnyboy200

macrumors newbie
Nov 6, 2012
10
1
Once, there was some weird glitch with my iCloud account, and my Mac was locked without any reason.
The PIN code consists just of 4 numbers (10000 values total), so I solved this problem with stupid Bruteforce method.
Spent several hours on that, because every 5 tries, you need to reboot your Mac to reset the "waiting" counter,
and reboot takes almost 1 minute. Was not bored at all: there was a PC near me and I used it for Internet browsing.

But, after this situation, I am really worried about this feature: since the real thief could do the same thing as me
and unlock the Mac in less than one day, then this feature does not bring any security at all! :mad:
Should be more numbers, or letters as well - otherwise, it just too easy!

I found a way to stop the freeze on entering the password. After 5 attempts, open up the language options and cancel. Presto... another instant 5 attempts. Repeat.
 
  • Like
Reactions: Pcmacanik

ExciteWalk

macrumors member
Original poster
Sep 11, 2012
46
7
Sorry guys, my server went bonkers for a while, had to fix it..

@ronmathews, were you able to find the file I referenced in step 4?

@Nobann, that as far as I know, that file will only force an admin account to be added. But that's beneath the locked the firmware, so it won't help here.

@AppleMacFinder, wow you are a trooper! I thought about doing that, but man 10,000 values was just not worth my time. Easier to hack it, lol. :D

@imaam7700, you tried all 10,000 combinations?! Wow.
At this point you cannot start fresh with the Mac as if it was straight from the factory. The stuff that runs it was locked, and so you would have to replace the stuff inside to get it back to factory condition. Formatting will remove any chance of finding the key again and will set you back further.

@johnnyboy200, nice trick lol.
 

imaam7700

macrumors newbie
Nov 8, 2012
3
0
@imaam7700, you tried all 10,000 combinations?! Wow.
At this point you cannot start fresh with the Mac as if it was straight from the factory. The stuff that runs it was locked, and so you would have to replace the stuff inside to get it back to factory condition. Formatting will remove any chance of finding the key again and will set you back further.

@johnnyboy200, nice trick lol.

ok
i found 2 .lock files
and 2 files without extention in the folder:

\Users\username\Library\Application Support\iCloud\Accounts

not in
\Users\username\Library\Application Support\iCloud

it were

53974024
53974024.lock
1351295913
1351295913.lock

i tried all the numbers like that
5397
3974
9740
7402
4024

and i did the same with 2th file numbers

is that what you mean ?

btw i installed another hd

and if faced this folder

v5g9iq.jpg


i tried to install mac os x lion with a cd
but i couldn't
 
Last edited by a moderator:

ExciteWalk

macrumors member
Original poster
Sep 11, 2012
46
7
@imaam7700, it shows that "?" folder because it's looking for the lock status on the locked hard drive. It will not cooperate with other drives or operating systems.
 

ronmathews

macrumors newbie
Nov 2, 2012
15
0
here is what i did i plugged the cloned drive to to a snow leopard virtual machine and tried to recover, nothing came off of it.. and i plugged the original ssd of the macpro into the virtual machine the recovery Hd is intact, and the efi partition is intact, but the Macintosh Hd is only freakin 120 mb in size used and got the whole 110 gbs free ??? so i tried to pull the files from it using disk warrior, stellar phoenix, disk genius my virtual machine crashes half way through, so if u guys tell me what i should recover or restore ???? and i did clone the recovery partition seperate and expanded it with transmac in windows and read it from the vm.. i see a whole bunch of password.efires.. efi boot.efires and frimware.efires so if any of you are willing to work on it i can upload the files u can give it a shot and see.. please keep in mind iam not that literate with commands and terminologies just tell me simple english ..i ll post it..
 

ExciteWalk

macrumors member
Original poster
Sep 11, 2012
46
7
@ronmathew, to be clear, you're running Mac in a VM on a PC, correct?
You also replaced the locked Mac partition with a fresh "working" system, but the original is still backed up somewhere?
Go ahead and upload those files somewhere and I'll take a look.
And how did you get yours locked in the first place? OS ugrade or just messing with the lock feature?
 

ronmathews

macrumors newbie
Nov 2, 2012
15
0
@excite

@ronmathew, to be clear, you're running Mac in a VM on a PC, correct?
You also replaced the locked Mac partition with a fresh "working" system, but the original is still backed up somewhere?
Go ahead and upload those files somewhere and I'll take a look.
And how did you get yours locked in the first place? OS ugrade or just messing with the lock feature?

yes iam running it on a pc, yes i tried using lion,snow leopard and mountain lion dp on a different hard drive and tried to boot
and also tried a cloned ML install esd disk on the hard drive

it only boots to a ?

and when i try to boot with the option button it asks for a password
and by the way i bought it for 100 bucks off a crackhead on the street..lol

right now i have connected the original ssd which came with the macbook onto the virtual machine and using stellar phoenix in advanced recovery.. looks like its gonna take a while but as soon as i get anything out of it i ll post
 

Queen6

macrumors G4
Little good is going to come out of this thread; if some one does work it out, all thats going to happen is it`s going to make the thieves life a lot easier.

As the guy openly states "I'm working on a preowned laptop which was likely stolen because "find my mac" message popped up and the computer locked."

Undoubtedly the average Mac owner relies on this security protocol to protect their Mac`s and personal data in the event of a theft, all we are doing here is undoing that layer of protection. If your going to do this have the good sense to keep it offline, before the harm is done...
 
Last edited:

ExciteWalk

macrumors member
Original poster
Sep 11, 2012
46
7
@ronmathews, the "?" is expected when you install a different drive or OS because the firmware is looking for the original installation when it became locked. Let me know what you get from the recovery.

@Queen6, ooh, you came back :)
Um, that's Apple's issue really. I had a legitimate problem with this "security layer" and undoubtedly so do many other people. Are you asking me to be selfish and hold back my help? If Apple can't fix it, it's up to us, the community.

@johnnyboy200, that's what I/we are trying to figure out. I don't have a Mac to do my own testing, but if you're willing to help figure it out, I'll send you instructions to check some things for me.
 

ronmathews

macrumors newbie
Nov 2, 2012
15
0
@excite

nothing came out the virtual machine crashed, i started working on another macbook pro upgrading it to mountain lion, once finished install gonna try from it
 

Queen6

macrumors G4
@Queen6, ooh, you came back :)
Um, that's Apple's issue really. I had a legitimate problem with this "security layer" and undoubtedly so do many other people. Are you asking me to be selfish and hold back my help? If Apple can't fix it, it's up to us, the community

I never went away, as your post is not without interest ;) all the same my statement still stands those with ill intent have the most to benefit from shall we say a successful outcome to this thread. Apple`s implementation is certainly not perfect, equally as is clearly illustrated here the hardware/software combination of the lock is highly likely to frustrate the vast majority of thieves, rendering the machine useless and most importantly protecting personal data.

I have no issue with you helping someone in genuine need, conducting it on a public forum, can have a lot more implication. You can just as easily do the same by mail or PM?

As for helping the community there are few threads on this line, so i rather believe that Apple`s implementation is not so flawed. As with all in life you are entitled to your opinion and direction, and i do agree that Apple need to step up the security. the biggest flaw to me is that everything revolves around the Apple user name, should this be compromised, things can get very bad very fast. Anyways i`m out good luck with it either ways :apple:
 
Last edited:

AppleMacFinder

macrumors 6502a
Dec 7, 2009
796
152
the biggest flaw to me is that everything revolves around the Apple user name, should this be compromised, things can get very bad very fast.

I thought, it is already compromised (at least, some popular videos at Youtube show that)
 

Queen6

macrumors G4
I thought, it is already compromised (at least, some popular videos at Youtube show that)

I don't believe it`s right "out there" however it`s clearly not impossible to do, if the Apple ID is compromised all hell can break loose, system`s can be remotely locked with obvious consequence, worse still they can be wiped with catastrophic result. So in many respects "Find My Mac" is very much a "double edged sword" it can protect you, equally it can harm you if your Apple ID falls into the wrong hands, no easy answers.

As Apple, Mac, OS X gain further traction in the market, so will the likelihood of attack and or malicious code will ever increase. As for "Find My Mac" like many things you need to consider when to use it an when not to use it. Functionality is another thing; lock, wipe are of use locate is another thing entirely as the accuracy is too poor to be of realistic use...
 
Status
Not open for further replies.
Register on MacRumors! This sidebar will go away, and you'll see fewer ads.