Can I get a hash of the recovery partition on OSX to ensure it hasn't been tampered with?
0
I didn't have physical access to my machine (2008 macbook unibody 5,1, el capitan) and found out it had been tampered with (files destroyed on unencrypted hd). The missing files were 'only' artwork/writings and basic operation seems to still work. I was going to reinstall everything but realized about the recovery partition and boot process being able to be altered. I was wondering if I could get an md5 hash of the recovery/hidden partition and compare against a known good copy. I don't use time machine and haven't written to the recovery partition that I know of.
EDIT: I can obtain an md5 hash of my own, but I am not sure if it should be unique/alterable, and if so I need a known good hash to compare.
macos osx-el-capitan
asked Jan 18 at 18:39
crazyfoxcrazyfox
113
add a comment |
0
I didn't have physical access to my machine (2008 macbook unibody 5,1, el capitan) and found out it had been tampered with (files destroyed on unencrypted hd). The missing files were 'only' artwork/writings and basic operation seems to still work. I was going to reinstall everything but realized about the recovery partition and boot process being able to be altered. I was wondering if I could get an md5 hash of the recovery/hidden partition and compare against a known good copy. I don't use time machine and haven't written to the recovery partition that I know of.
EDIT: I can obtain an md5 hash of my own, but I am not sure if it should be unique/alterable, and if so I need a known good hash to compare.
macos osx-el-capitan
asked Jan 18 at 18:39
crazyfoxcrazyfox
113
I would think that Apple would bake the same recovery partition, but to test it you would have to access the same mac model with the same OS X version to compare hashes between the two. If you are really worried, I recommend purchasing a retail disk of OS X and wiping all partitions of the disk and re-installing. This way you wouldn't have to worry about hashes, and is the easiest option if you want to be fully sure its safe.
– QuickishFM
Jan 18 at 21:26
@QuickishFM, Yeah I am trying to call some tech shops to see if they will give me a hash off the same model. I thought Apple might supply but I can't find it online. It occurred to me while working on this, that even though I have been the only owner of this machine and purchased it new, there is pretty much no hope of ever even being able to even speak to an actual Apple employee.
– crazyfox
Jan 18 at 21:32
I'll be honest, this is the first case of hashing a partition that I've seen, even though its understandable. To find out if the partitions are all the same, you'll need hashes from different machines (to make sure its not unique to each model), if they are willing to co-operate at all. If you can confirm that a retail DVD of Mac OS X will replace the recovery partition, then I think its the best way to get it back to 'vanilla' recovery partition, unless you want evidence that it was tampered with.
– QuickishFM
Jan 18 at 21:38
I don't think the hash of the entire volume will match, even between "identical" computers running the same macOS version -- the volume includes things like file timestamps, that are likely to depend on e.g. the exact time the system was installed (& the recovery partition created). How about starting from Internet Recovery (Option-Command-R instead of just Command-R)? That way, you're booting directly from an Apple server. You could then completely wipe the internal HD (including Recovery) and reinstall from scratch.
– Gordon Davisson
Jan 19 at 1:52
add a comment |
0
0
0
I didn't have physical access to my machine (2008 macbook unibody 5,1, el capitan) and found out it had been tampered with (files destroyed on unencrypted hd). The missing files were 'only' artwork/writings and basic operation seems to still work. I was going to reinstall everything but realized about the recovery partition and boot process being able to be altered. I was wondering if I could get an md5 hash of the recovery/hidden partition and compare against a known good copy. I don't use time machine and haven't written to the recovery partition that I know of.
EDIT: I can obtain an md5 hash of my own, but I am not sure if it should be unique/alterable, and if so I need a known good hash to compare.
macos osx-el-capitan
asked Jan 18 at 18:39
crazyfoxcrazyfox
113
I didn't have physical access to my machine (2008 macbook unibody 5,1, el capitan) and found out it had been tampered with (files destroyed on unencrypted hd). The missing files were 'only' artwork/writings and basic operation seems to still work. I was going to reinstall everything but realized about the recovery partition and boot process being able to be altered. I was wondering if I could get an md5 hash of the recovery/hidden partition and compare against a known good copy. I don't use time machine and haven't written to the recovery partition that I know of.
EDIT: I can obtain an md5 hash of my own, but I am not sure if it should be unique/alterable, and if so I need a known good hash to compare.
macos osx-el-capitan
macos osx-el-capitan
asked Jan 18 at 18:39
crazyfoxcrazyfox
113
asked Jan 18 at 18:39
crazyfoxcrazyfox
113
edited Jan 18 at 20:17
crazyfox
asked Jan 18 at 18:39
crazyfoxcrazyfox
113
asked Jan 18 at 18:39
crazyfoxcrazyfox
113
asked Jan 18 at 18:39
crazyfoxcrazyfox
113
113
I would think that Apple would bake the same recovery partition, but to test it you would have to access the same mac model with the same OS X version to compare hashes between the two. If you are really worried, I recommend purchasing a retail disk of OS X and wiping all partitions of the disk and re-installing. This way you wouldn't have to worry about hashes, and is the easiest option if you want to be fully sure its safe.
– QuickishFM
Jan 18 at 21:26
@QuickishFM, Yeah I am trying to call some tech shops to see if they will give me a hash off the same model. I thought Apple might supply but I can't find it online. It occurred to me while working on this, that even though I have been the only owner of this machine and purchased it new, there is pretty much no hope of ever even being able to even speak to an actual Apple employee.
– crazyfox
Jan 18 at 21:32
I'll be honest, this is the first case of hashing a partition that I've seen, even though its understandable. To find out if the partitions are all the same, you'll need hashes from different machines (to make sure its not unique to each model), if they are willing to co-operate at all. If you can confirm that a retail DVD of Mac OS X will replace the recovery partition, then I think its the best way to get it back to 'vanilla' recovery partition, unless you want evidence that it was tampered with.
– QuickishFM
Jan 18 at 21:38
I don't think the hash of the entire volume will match, even between "identical" computers running the same macOS version -- the volume includes things like file timestamps, that are likely to depend on e.g. the exact time the system was installed (& the recovery partition created). How about starting from Internet Recovery (Option-Command-R instead of just Command-R)? That way, you're booting directly from an Apple server. You could then completely wipe the internal HD (including Recovery) and reinstall from scratch.
– Gordon Davisson
Jan 19 at 1:52
add a comment |
I would think that Apple would bake the same recovery partition, but to test it you would have to access the same mac model with the same OS X version to compare hashes between the two. If you are really worried, I recommend purchasing a retail disk of OS X and wiping all partitions of the disk and re-installing. This way you wouldn't have to worry about hashes, and is the easiest option if you want to be fully sure its safe.
– QuickishFM
Jan 18 at 21:26
@QuickishFM, Yeah I am trying to call some tech shops to see if they will give me a hash off the same model. I thought Apple might supply but I can't find it online. It occurred to me while working on this, that even though I have been the only owner of this machine and purchased it new, there is pretty much no hope of ever even being able to even speak to an actual Apple employee.
– crazyfox
Jan 18 at 21:32
I'll be honest, this is the first case of hashing a partition that I've seen, even though its understandable. To find out if the partitions are all the same, you'll need hashes from different machines (to make sure its not unique to each model), if they are willing to co-operate at all. If you can confirm that a retail DVD of Mac OS X will replace the recovery partition, then I think its the best way to get it back to 'vanilla' recovery partition, unless you want evidence that it was tampered with.
– QuickishFM
Jan 18 at 21:38
I don't think the hash of the entire volume will match, even between "identical" computers running the same macOS version -- the volume includes things like file timestamps, that are likely to depend on e.g. the exact time the system was installed (& the recovery partition created). How about starting from Internet Recovery (Option-Command-R instead of just Command-R)? That way, you're booting directly from an Apple server. You could then completely wipe the internal HD (including Recovery) and reinstall from scratch.
– Gordon Davisson
Jan 19 at 1:52
I would think that Apple would bake the same recovery partition, but to test it you would have to access the same mac model with the same OS X version to compare hashes between the two. If you are really worried, I recommend purchasing a retail disk of OS X and wiping all partitions of the disk and re-installing. This way you wouldn't have to worry about hashes, and is the easiest option if you want to be fully sure its safe.
– QuickishFM
Jan 18 at 21:26
I would think that Apple would bake the same recovery partition, but to test it you would have to access the same mac model with the same OS X version to compare hashes between the two. If you are really worried, I recommend purchasing a retail disk of OS X and wiping all partitions of the disk and re-installing. This way you wouldn't have to worry about hashes, and is the easiest option if you want to be fully sure its safe.
– QuickishFM
Jan 18 at 21:26
@QuickishFM, Yeah I am trying to call some tech shops to see if they will give me a hash off the same model. I thought Apple might supply but I can't find it online. It occurred to me while working on this, that even though I have been the only owner of this machine and purchased it new, there is pretty much no hope of ever even being able to even speak to an actual Apple employee.
– crazyfox
Jan 18 at 21:32
@QuickishFM, Yeah I am trying to call some tech shops to see if they will give me a hash off the same model. I thought Apple might supply but I can't find it online. It occurred to me while working on this, that even though I have been the only owner of this machine and purchased it new, there is pretty much no hope of ever even being able to even speak to an actual Apple employee.
– crazyfox
Jan 18 at 21:32
I'll be honest, this is the first case of hashing a partition that I've seen, even though its understandable. To find out if the partitions are all the same, you'll need hashes from different machines (to make sure its not unique to each model), if they are willing to co-operate at all. If you can confirm that a retail DVD of Mac OS X will replace the recovery partition, then I think its the best way to get it back to 'vanilla' recovery partition, unless you want evidence that it was tampered with.
– QuickishFM
Jan 18 at 21:38
I'll be honest, this is the first case of hashing a partition that I've seen, even though its understandable. To find out if the partitions are all the same, you'll need hashes from different machines (to make sure its not unique to each model), if they are willing to co-operate at all. If you can confirm that a retail DVD of Mac OS X will replace the recovery partition, then I think its the best way to get it back to 'vanilla' recovery partition, unless you want evidence that it was tampered with.
– QuickishFM
Jan 18 at 21:38
I don't think the hash of the entire volume will match, even between "identical" computers running the same macOS version -- the volume includes things like file timestamps, that are likely to depend on e.g. the exact time the system was installed (& the recovery partition created). How about starting from Internet Recovery (Option-Command-R instead of just Command-R)? That way, you're booting directly from an Apple server. You could then completely wipe the internal HD (including Recovery) and reinstall from scratch.
– Gordon Davisson
Jan 19 at 1:52
I don't think the hash of the entire volume will match, even between "identical" computers running the same macOS version -- the volume includes things like file timestamps, that are likely to depend on e.g. the exact time the system was installed (& the recovery partition created). How about starting from Internet Recovery (Option-Command-R instead of just Command-R)? That way, you're booting directly from an Apple server. You could then completely wipe the internal HD (including Recovery) and reinstall from scratch.
– Gordon Davisson
Jan 19 at 1:52
add a comment |
0
active
oldest
votes
Your Answer
StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "3"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});
function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});
}
});
draft saved
draft discarded
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fsuperuser.com%2fquestions%2f1395870%2fcan-i-get-a-hash-of-the-recovery-partition-on-osx-to-ensure-it-hasnt-been-tampe%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
0
active
oldest
votes
0
active
oldest
votes
active
oldest
votes
active
oldest
votes
draft saved
draft discarded
Thanks for contributing an answer to Super User!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
draft saved
draft discarded
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fsuperuser.com%2fquestions%2f1395870%2fcan-i-get-a-hash-of-the-recovery-partition-on-osx-to-ensure-it-hasnt-been-tampe%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
I would think that Apple would bake the same recovery partition, but to test it you would have to access the same mac model with the same OS X version to compare hashes between the two. If you are really worried, I recommend purchasing a retail disk of OS X and wiping all partitions of the disk and re-installing. This way you wouldn't have to worry about hashes, and is the easiest option if you want to be fully sure its safe.
– QuickishFM
Jan 18 at 21:26
@QuickishFM, Yeah I am trying to call some tech shops to see if they will give me a hash off the same model. I thought Apple might supply but I can't find it online. It occurred to me while working on this, that even though I have been the only owner of this machine and purchased it new, there is pretty much no hope of ever even being able to even speak to an actual Apple employee.
– crazyfox
Jan 18 at 21:32
I'll be honest, this is the first case of hashing a partition that I've seen, even though its understandable. To find out if the partitions are all the same, you'll need hashes from different machines (to make sure its not unique to each model), if they are willing to co-operate at all. If you can confirm that a retail DVD of Mac OS X will replace the recovery partition, then I think its the best way to get it back to 'vanilla' recovery partition, unless you want evidence that it was tampered with.
– QuickishFM
Jan 18 at 21:38
I don't think the hash of the entire volume will match, even between "identical" computers running the same macOS version -- the volume includes things like file timestamps, that are likely to depend on e.g. the exact time the system was installed (& the recovery partition created). How about starting from Internet Recovery (Option-Command-R instead of just Command-R)? That way, you're booting directly from an Apple server. You could then completely wipe the internal HD (including Recovery) and reinstall from scratch.
– Gordon Davisson
Jan 19 at 1:52