Become a MacRumors Supporter for $50/year with no ads, ability to filter front page stories, and private forums.

jbrd43

macrumors newbie
Original poster
Jan 2, 2020
6
0
Hello all, I am new to this community, but I have using a Macbook Pro since about 2015. I don't have a ton of experience with MacOS X on it, but quite a bit with Ubuntu Linux.

Unfortunately someone in my family forgot to flip the latch on the back sliding door one night almost a week ago now. The next morning, we noticed that the door was unlocked, but nothing really seemed to be missing and nobody had heard anything in the night. Felt almost too good to be true.
After about an hour of assuming that everything was fine, "have you seen my laptop?"
It was a super bummer!

Its a 2012 Macbook pro 10.1 running a dual boot with Ubuntu 19.10 as default, and MacOS 10.8 Mountain Lion as an alternate. A little old by today's standards, but running Linux, its rock solid. I barely ever used MacOS, but at least had set up "find my mac" when I first got it.

We have reported this to the police, and have spoken to Apple directly about it. Both of which have been extremely unhelpful.

While researching Macbooks back before I purchased it, I was particularly curious about their security features, being that we're talking about such an expensive device. So I went to the Apple store, and asked them specifically how "find my mac" works, and whether or not it would work if the laptop were running an alternative OS such as Linux or Windows, since I knew I would definitely be using one or both of those at least as a dual boot. The multi-OS compatibility was a big draw to this platform. They of course assured me that everything "find my mac" needs in order to function is hardware and firmware based, and that it will work regardless of what OS is running so long as the device connects to the internet. I then had them confirm this with several other employees, because I wanted to be extra sure, but they all claimed the same.

From what I can put together, what the Apple store told me sounds like an implementation of Intel's AT technology. My i7-3720qm does have AT if you look at the specs at Intel.
Here is the feature breakdown for Intel AT:
Looks about right, It claims that it works even when the disk is wiped with a new OS because its built into the chip.
upon further reading though, it appears Intel AT has not only been discontinued on all products made since 2015, but any current subscriptions(in 2015) had to be ended or they would be locked out of their device at end of term.
https://community.mcafee.com/t5/Ant...eft-Service-has-been-discontinued/td-p/368217
Now this is Mcaffee, which was acquired by Intel a while back, but the same seems to hold true for other providers:
Intel however is apparently no longer in the Anti-Theft business.

Unfortunately "find my mac" has been completely silent for almost a week now.

Now I get that it could be that it simply hasn't connected to a network yet, but seems extremely unlikely after this much time. According to the police, items like these, particularly those taken during home invasions, change hands almost immediately, and will continue to do so until someone ends up with it who has the skills to make use of it. Not that it would be hard, as Ubuntu was set to auto-boot to the desktop without credentials into a "guest" sort of account. I always figured if anyone ever took it I wanted to make sure they were easily able to connect to a wifi nearby. It also auto connects if an open wifi is present.

So issue real issue is, I need to find a fellow Macbook user who either runs Linux, or can try booting up their macbook with a Ubuntu(or other) live-drive. I need to know whether you are able to use the "find my mac" feature on your icloud account to locate your Macbook when running Linux/Ubuntu, assuming it is network connected.
If you need any help getting the livedrive to work with your particular hardware, I should be able to help. It was a little backwards getting the wifi device working on mine, but pretty simple still, just a few clicks in the right places. I am guessing newer devices hopefully may not have this issue.

Please if you have any information at all that would be of any help at all I would appreciate it so much!
All other outlets have failed me, this is my last straw.
Thank you all so much!
 
You're SOL. Find My Mac needs macOS to be running.

Given the age of the machine (mid-2012, first ever retina model), you're best off simply accepting that the machine is gone and getting a new one.
 
  • Like
Reactions: 26139 and me55
I was afraid of that. The people at the apple store seemed awfully sure that it did not need MacOS, or I would have hopefully taken other measures.

I have come to terms with the fact I may never see it again, but I am not going to just stop trying at least.

So you're sure that Macos has to be running? How come they want you to connect to wifi upon efi boot selection. Wouldn't that do the trick, if someone were to connect that way?

Anyways upon a little further reading, I did find a little more promising info saying that at least some macbooks store the "find my mac" settings in NVRAM.



Do you or does anyone else know if my macbook has NVRAM, and if so, this should potentially be able to help me, no? I have read that most Intel macs do.
 
Well if it's running 10.8 Mountain Lion I'm afraid all this discussion of find my Mac is a moot point - 10.8 did not include this feature.
 
The geniuses are worthless so much of the time. I’ve had some really frustrating experiences recently. I’m not surprised they gave you the wrong information about find my Mac.
 
I believe it became available in 10.7.2 as part of iCloud.
oops my bad. I was sure it wasn’t introduced at that point, but you are right. Thanks.

 
Thanks you all for the replys. @applesed thank you, yes we are very thankful for that.

Mountain lion does in fact have find my mac, and I am 99% sure that it should have the NVRAM also. If you read the info on the links I provided on NVRAM it says that there is a sort of "find my mac" ID number or some such that is written to persistent memory, that is not part of the hard disk.

So people's old macs were showing up in their icloud account when they used find my mac to locate their new devices even after the old ones had been reset to factory settings and passed on to someone else (sold) who then registered their own Icloud account.
Both of the examples though seemed to be similar situations where the disk had been wiped, but they were running Macos still. The difference here is the absence of easily accessible Macos.

Can anyone confirm whether the Info stored in NVRAM is still reliant on Macos to work with "find my mac? I am guessing that is probably the case, here as well but I wanted to confirm.

Perhaps the only hope is that someone installs Macos, or figures out how to boot my install of it.

I would say it's a pretty good chance that someone will probably install Macos at some point, being that it is a Macbook after all.

So maybe there is still some hope after all.

As long as nobody figures this little detail out, as it appears the NVRAM can be cleared with a few key strokes upon boot. Ouch.
 
From my understanding, the T2 security chip only surfaced in machines a year ago. Yours is 8 years old mate. There's no magic hardware find my mac feature.
[automerge]1578148422[/automerge]
Literally my first post in 10 years. All thanks to you. Otherwise I'd have probably made it to 16 or 17 years.
 
Last edited:
  • Like
Reactions: retta283
From my understanding, the T2 security chip only surfaced in machines a year ago. Yours is 8 years old mate. There's no magic hardware find my mac feature.
[automerge]1578148422[/automerge]
Literally my first post in 10 years. All thanks to you. Otherwise I'd have probably made it to 16 or 17 years.
I made it 8 years before I rejoined to post.
 
@retta283 and @aussiedj Glad to hear you both have come out of the woodwork in order to help me, I appreciate it!

Now there is no T2 chip in mine, as that has only been around 2 years, but NVRAM dates all the way back to PRAM which preceded it. PRAM or "Parameter Ram" was just like NVRAM a battery backed up set of settings, or "parameters"
NVRAM was the next evolution of that which is part of all Intel macbooks. I have read detailed descriptions of how it can be read, how to clear it if you are having certain issues, etc.

So the question is not anymore whether it has NVRAM, I think I confirmed that on my own. The question is, does it still need Macos in order to use the data in NVRAM linking my macbook to my account?


If you read here it still works after disk has been wiped due to NVRAM data, but in MacOS. I am hoping that the same might be true if it were any other OS ( I don't see any reason why that's not possible, seems like it would be pretty simple to send signal through connected wifi)

If that is sadly not the case, then I just have to wait for someone to install Macos, and it should show up!
Is that a fair assumption?

@Camarillo Brillo Yeah its funny how they are so quick to assure you that all your concerns are taken care of when they are trying to sell you something, but when it comes down to actually performing said function, they are completely clueless. I wonder where they get their information. Sounds to me like they read the flyer for Intel AT without confirming that apple even used Intel AT, which they don't and never did. Probably just assumed that they did because MB's have Intel CPU's...
 
You will never see your Macbook Pro again, and pursuing this further will only lead to frustration and perhaps drama. Let's say someone installs MacOS on the MBP that was stolen, aye? You can get their general location by using the Find My Mac feature. But aha, you can get the general location of where their IP address originates. I live on a mountain in Caliornia and my IP originates in Nevada, as an example. Honestly, just move on. Only pursue this out of morbid curiosity if you must push forward.
 
  • Like
Reactions: Fishrrman
Even if there is something in NVRAM, you probably need to be booted into OSX for the OS to talk to the iCloud server.

I think your only hope is that the thief learns how to boot into OSX, logs in as a guest (if enabled, or if your user volume isn’t password protected and they log into that) and connects the system to the internet.

EDIT:
As a side point for future reference, this is why it’s a good practice to have your machine set to boot OSX/macOS (even if you dual boot), and have a firmware password to boot anything else enabled. Also have a password on your account and a guest account enabled.

that way, if your machine gets stolen, thief can only boot into the guest account and nothing else. That maximizes probability they will connect the machine to the internet so that iCloud and Find My can do their thing, while still keeping your data protected and preventing thief from wiping the machine (FW password). On T2 machines a lot of this is baked in.
 
Last edited:
You will never see your Macbook Pro again, and pursuing this further will only lead to frustration and perhaps drama. Let's say someone installs MacOS on the MBP that was stolen, aye? You can get their general location by using the Find My Mac feature. But aha, you can get the general location of where their IP address originates. I live on a mountain in Caliornia and my IP originates in Nevada, as an example. Honestly, just move on. Only pursue this out of morbid curiosity if you must push forward.
This is a bit pessimistic. I don’t want to get OP hopes up, but I’d say it’s 50:50 and that’s definitely worth pursuing.

On the location aspect, it is much more powerful than simply logging IP address on apples iCloud backend. Apple logs all kinds of data when the machine checks in, and they log it across all users and devices, so their ability to locate devices leveraging correlated data is actually quite powerful.

For example, the stolen machine checks in with iCloud. It reports its IP address, the WiFi network it’s connected to, a list of all the WiFi networks in range and their signal strengths, and ditto for Bluetooth devices. Since all devices talking to iCloud are doing the same thing, and many are iPhones with additional GPS data, Apple can pinpoint location of a device, even a MacBook, with much greater accuracy than just an IP lookup.
 
  • Like
Reactions: 4sallypat
This is a bit pessimistic. I don’t want to get OP hopes up, but I’d say it’s 50:50 and that’s definitely worth pursuing.

On the location aspect, it is much more powerful than simply logging IP address on apples iCloud backend. Apple logs all kinds of data when the machine checks in, and they log it across all users and devices, so their ability to locate devices leveraging correlated data is actually quite powerful.

For example, the stolen machine checks in with iCloud. It reports its IP address, the WiFi network it’s connected to, a list of all the WiFi networks in range and their signal strengths, and ditto for Bluetooth devices. Since all devices talking to iCloud are doing the same thing, and many are iPhones with additional GPS data, Apple can pinpoint location of a device, even a MacBook, with much greater accuracy than just an IP lookup.

lol if you think the police are gonna pursue this. that’s the only point of escalation open to them, and the our boys in blue gang couldn’t care less.

I suppose there’s a deranged second option, using the data provided by Find my Mac to directly attempt retrieval, but uhhh that’s an even worse idea than assuming cops will bother with this matter.
 
tl;dr -- but...

In August 2018 I had a B&E at my house when I was away. My 2009 15" MacBook Pro (running OS X 10.11 El Capitan) was stolen among many other items. It had had Find My Mac switched on and a login password. I wiped it remotely using Find My Mac. I filed the police report and insurance claim and not much happened for about three weeks.

Then one evening during dinner my iPhone flashed-up a "Find My Mac" alert that my MacBook Pro had just been switched-on and it gave me a map and approximate address on the other side of town. I called the police immediately and gave them the information and they immediately recognized it as a known drug house. An hour later I got a call back that my laptop had been recovered. It was missing the protective case, and it was dirty & dented and the camera had a piece of pink tape covering it.

When I fired-it back up it had been completely wiped of all data which I believe happened the first time it was switched on as it "phoned home". So the technology worked perfectly; my personal data was wiped and I got the computer back -- and I'm still using it today.

At the risk of sounding like a "fanboy" -- trust Apple's technology. Switch on "Find My Mac" and it will work. Don't risk weird third-party apps. Apple knows what they're doing.
 
FYI -- if you've never seen "Find My Mac" in action when a Mac is reported stolen -- it enters the normal boot-up screen but the progress bar crawls along really slowly. My SSD MBP normally booted in a few seconds but when flagged as Stolen it took about five minutes. In that time it wipes the user accounts and surveys local WiFi networks to figure out where it is. Then it somehow joins one of them and phones home with location information -- all while it still appears to be booting-up. It then becomes iCloud-locked when it finally starts.

Kinda cool.
 
lol if you think the police are gonna pursue this. that’s the only point of escalation open to them, and the our boys in blue gang couldn’t care less.

I suppose there’s a deranged second option, using the data provided by Find my Mac to directly attempt retrieval, but uhhh that’s an even worse idea than assuming cops will bother with this matter.
That’s only true in a major city (like LA, NYC, Chicago etc.). Literally any suburb or country side PD will roll a car out to a location if you give them actionable location info for property theft. It might take a few days, but they’ll get to it.

Especially since this was a B&E that just happened to include a stolen computer...
 
In August 2018 I had a B&E at my house when I was away. My 2009 15" MacBook Pro (running OS X 10.11 El Capitan) was stolen among many other items. It had had Find My Mac switched on and a login password. I wiped it remotely using Find My Mac. I filed the police report and insurance claim and not much happened for about three weeks.
So you had a login password, preventing anybody from logging in. Let alone logging in and connecting to any wifi. And you wonder why it never came back online...
 
So you had a login password, preventing anybody from logging in. Let alone logging in and connecting to any wifi. And you wonder why it never came back online...

Maybe my message was tl;dr but actually it DID go online, report its location accurately, and wipe my user account as it was supposed to. Everything worked, the police went and seized it and I got it back. There's some secret WiFi magic behind the scenes because somehow it did manage to get on a network and phone home. My point being -- trust Apple, they know what they're doing.
 
@Dovahkiing
Regarding NVRAM:
This is the same I am starting to suspect, is that it will take someone booting Macos, but for someone to boot my OSX install, they will need to learn EFI booting. I am more hopeful that someone just installs MacOS from scratch, wipes it clean, boots it up, and connects to Wifi, as then it should phone home.
The rest:
Thank you for the encouraging words. Lesson learned. Next time I will make sure MacOS stays the default boot no matter what other OS I am using, and not to listen to anything anyone tells me at the Apple store...

@faust I have most certainly already considered what you are saying, and if I were to locate it, It would most likely not be out in the mountains where theres no wifi around, and it would unlikely be a network cable, as there is no rj-45 plug on this model. It is however extremely likely it would be in the general metropoplitan area it was taken from, in which case it would have a very accurate geolocation based on nearby Wifi signals. I would then give the address where it was at to the police, and hopefully they would be able to recover it.

@eRondeau
Thank you for chiming in, sorry about the length. I am very happy to hear that you recovered your device, despite the damage the thieves did to it.
You said your device had been wiped, but what was installed on it when you got it back? Macos I guessing?


I think your device may have called home not neccesarily on the first boot, but after it was wiped.
If you take a real quick look at this:

Unfortunately my default boot was still defaulted to Linux from when I installed it. Also I was told at the apple store that find my mac would work regardless of the OS running so long as it was connected to internet.

It now seems that even though Find my mac can still work after device is wiped, it probably won't work with another OS booted as Apple store clamed. It sounds like it will take Macos being EFI booted to guest account (unlikely) or hopefully more likely wiped/reinstalled with Macos.

Still hoping someone can give me hard confirmation on that.

Thank you all for the kind words and help, it means a lot!
 
Well, I'm glad that police are willing to help people retrieve stolen computers. I've had no such luck even when I lived in suburbs or a city before I bought my home in the mountains, so yeah. Good thing for all Mac users that is. And eh, there are A LOT of wi-fi networks in my town. I have 100 Mb/s internet as a matter of fact, so I'm glad that the possibility of retrieval is there in case my laptop ever gets stolen.
 
FYI -- if you've never seen "Find My Mac" in action when a Mac is reported stolen -- it enters the normal boot-up screen but the progress bar crawls along really slowly. My SSD MBP normally booted in a few seconds but when flagged as Stolen it took about five minutes. In that time it wipes the user accounts and surveys local WiFi networks to figure out where it is. Then it somehow joins one of them and phones home with location information -- all while it still appears to be booting-up. It then becomes iCloud-locked when it finally starts.

Kinda cool.
The more I think about that, that is really amazing, and it leads me back to the original question. Has anyone actually TRIED locating a macbook running Linux?

A friend of mine said it should work, just like you said.

Hopefully someone here has a version of Linux running already, as that would make it a really easy test!



If nobody has actually tried this, would someone be willing to?

Its super easy to boot a live drive of Ubuntu and test it out. Who knows you might even like it enough to keep it. It runs great on macbooks.

Just make a flash drive of the Iso you can find here:

Once you make a flash drive of the image hold the option key upon reboot and select the USB as boot item, and boot to live desktop.

In order to get the wifi hardware working follow these steps:

It wants a network connection to install anything by default so you need to go to menu -> software sources -> additional repositories and check the Installation disk and hit OK to update.

Then, you have to enable 3rd party drivers. From the menu go to System -> Driver manager, and select the Broadcom WL driver and hit apply.
It should update drivers and wifi should work.
If you have any troubles, I should be able to help. I have done this a few times over the years...
Thanks again!
 
Register on MacRumors! This sidebar will go away, and you'll see fewer ads.