Sidebar Sidebar
Become a MacRumors Supporter for $50/year with no ads, ability to filter front page stories, and private forums.

Stolen Macbook Air - What can they do

N

-Node1-

macrumors newbie
Original poster
Aug 9, 2009
19
0
United Kingdom
Right so in May this year I had my 2012 11inch Macbook Air stolen from my car.

The laptop was running Find My Mac.
The laptop was running Mavericks.
The laptop was encrypted with Filevault.
The laptop had a password on the account.
The laptop was sleeping in my bag when it was stolen.

A few days later I got an email to say it had been found at a location some 30 miles away from my house.

The police went round to try and find it but nothing came of it.

Upon it being found I then locked it using Find My Mac.

My questions are:

If they take the hard drive out can they use the laptop with a new hard drive?
What would they need to unlock the locked mac?
If they format the mac does that mean the tracking is then useless?
Does the locked state mean the laptops effectively useless?
What happens if the hard drive is removed and read on a different mac could they still access the encrypted data?

I'm worried that my data could be at stake if they successfully managed to unlock the laptop somehow.

I fail to see how someone could just buy it and start using it again just like that.

Can apple flag the serial as stolen?
 
scaredpoet

scaredpoet

macrumors 604
Apr 6, 2007
6,627
342
-Node1- said:
My questions are:

If they take the hard drive out can they use the laptop with a new hard drive?
Click to expand...

Yes. In fact, they could use it with the same drive, if they put it in recovery mode, wipe the drive and re-install.

Only way to prevent this is to set an EFI password, to lock down recovery mode.

What would they need to unlock the locked mac?
Click to expand...

To access your data? They need either your username/password or the recovery key that was set up when FileVault was turned on.

To wipe the drive and start fresh? They just need to know to hold down Command+R on boot. They will not have access to your data, however.

If they format the mac does that mean the tracking is then useless?
Click to expand...

Yep. It won't be trackable on Find My Mac after that.

Does the locked state mean the laptops effectively useless?
Click to expand...

Not unless you set the EFI password. No EFI password, the Mac can be reformatted and reused.

What happens if the hard drive is removed and read on a different mac could they still access the encrypted data?
Click to expand...

They would need your unlock password or recovery key. Without these, they cannot access the data, but they can reformat the drive.

I'm worried that my data could be at stake if they successfully managed to unlock the laptop somehow.
Click to expand...

If they manage to unlock he laptop, then yes, your data would be at risk. But, they need to unlock your laptop. How hard that is depends on how difficult a password you set.

Can apple flag the serial as stolen?
Click to expand...

Can they? Maybe. Do they? Not that I know of.

As someone who has had my MacBook Pro stolen from my car as well, my condolences. But, unfortunately, I wouldn't count on getting it back at this point. You should check with your insurance company and see if any claim can be filed.
 
scaredpoet

scaredpoet

macrumors 604
Apr 6, 2007
6,627
342
Sort of. It sets a 4-digit code. I wouldn't consider that particularly secure though... given enough time someone would guess that, I'd imagine, if they were persistent.
 
N

-Node1-

macrumors newbie
Original poster
Aug 9, 2009
19
0
United Kingdom
It does? How do I know what it is, if it magically ever ends up back in my hands?

I can't imagine if the laptop even exists now, maybe someone wiped it even though it got locked (presumingly when they tried recovery mode and connected to a wifi network, when it first got nicked).
 
Weaselboy

Weaselboy

Moderator
Staff member
Jan 23, 2005
34,156
15,645
California
-Node1- said:
Doesnt locking the computer via FMM set an EFI password if it doesnt already have one?
Click to expand...

Yes it does.

-Node1- said:
It does? How do I know what it is, if it magically ever ends up back in my hands?

I can't imagine if the laptop even exists now, maybe someone wiped it even though it got locked (presumingly when they tried recovery mode and connected to a wifi network, when it first got nicked).
Click to expand...

Like scaredpoet mentioned, if they are persistent, they can just keep entering all 9,999 combinations until they hit the four digit code you entered. Apple does make this tough by blocking attempts for 15 minutes after a few bad entries (I can't recall how many).

If you ever got the machine back you would need to renter the code you sent to Find my Mac when you did the lock.
 
N

-Node1-

macrumors newbie
Original poster
Aug 9, 2009
19
0
United Kingdom
I do not remember telling FMM a code when i locked the computer.

What happens if they change the hard drive is the computer useable?
 
Weaselboy

Weaselboy

Moderator
Staff member
Jan 23, 2005
34,156
15,645
California
-Node1- said:
I do not remember telling FMM a code when i locked the computer.

What happens if they change the hard drive is the computer useable?
Click to expand...

You may have just erased it and not locked it... two different things.

If the PIN lock was applied and they install a new drive, that drive will also be locked. One would need to unlock the PIN and also put in a new drive to get out from under this.
 
N

-Node1-

macrumors newbie
Original poster
Aug 9, 2009
19
0
United Kingdom
I did definitely lock it it wont let me erase it now, it hasn't been seen on FMM since the day it was locked.

I can't imagine its just sitting around doing nothing, someone be using it in some fashion
 
maflynn

maflynn

macrumors Haswell
May 3, 2009
73,552
43,528
-Node1- said:
I did definitely lock it it wont let me erase it now, it hasn't been seen on FMM since the day it was locked.

I can't imagine its just sitting around doing nothing, someone be using it in some fashion
Click to expand...

Its gone at this point, the thief probably already wiped the computer and maybe even sold it.

Sorry to hear about your loss, though. Did you have File Vault enabled? That will protect your data, especially if you have credit card, bank information.
 
T

tiartrop

macrumors regular
Oct 28, 2008
148
2
I'm sorry for your loss but I can understand your concern. I got mine stolen sometime ago and worse it wasn't filevaulted. For a while I was worried they'd go through my data and do the unimaginable but nothing of the sort ever happened.

If you got filevault on then you're pretty safe, it'll take some serious determination to break into it and most likely they won't bother. They'll probably just format it and sell it/use it on their own.

Apple can definitely mark your laptop as stolen in their database, I'm not quite sure what'll happen if someone brings it to an Apple Store though.
 
O

orestes1984

macrumors 65816
Jun 10, 2005
1,000
4
Australia
scaredpoet said:
Sort of. It sets a 4-digit code. I wouldn't consider that particularly secure though... given enough time someone would guess that, I'd imagine, if they were persistent.
Click to expand...

A 4 digit code has 10,000 different possibilities given that you can use every digit more than once, they will be trying for a very long time given a manual brute force.
 
Last edited:
E

Epiphron

macrumors regular
Jul 25, 2010
234
10
orestes1984 said:
A 4 digit code has 10,000 different possibilities given that you can use every digit more than once, they will be trying for a very long time given a manual brute force.
Click to expand...

but a computer script can go through all 10000 possibilities extremely quickly..
 
C

cyber16

macrumors 6502
Jan 12, 2013
487
28
as I posted above
A low cost usb teensy board will try all 10k codes within a couple days.
With NO user input needed.
Program it and just plug it in and wait

It is by far best to enter in a long efi password phase right away and not depend on the limited find my four digit code

http://www.hackmac.org/forum/topic/1...-bruteforcing/
orestes1984 said:
A 4 digit code has 10,000 different possibilities given that you can use every digit more than once, they will be trying for a very long time given a manual brute force.
Click to expand...
 
You must log in or register to reply here.
Register on MacRumors! This sidebar will go away, and you'll see fewer ads.
Top Bottom