I have a 2011 Macbook Pro, running 10.8.2 and was worried that the laptop may have been tampered with while left unattended for a few days while abroad in Asia.
I have mounted my EFI partition using:
mkdir /Volumes/efi sudo mount -t msdos /dev/disk0s1 /Volumes/efi
In there I have found:
├── .Trashes │ ├── ._502 │ ├── ._508 │ ├── 502 │ └── 508 ├── .fseventsd │ └── fseventsd-uuid ├── BOOTLOG └── EFI └── APPLE ├── CACHES ├── EXTENSIONS │ └── Firmware.scap └── FIRMWARE ├── 2011MBP15.smc └── SmcFlasher.efi
I repartitioned the computer and enabled filevault just before New Year's Eve 2013 and so thought it strange that the folder /Volumes/efi/.Trashes/._508 exists and is dated 2 Nov 2012. Also I don't recall ever having had a user with id as high as 508. (Only have 3 accounts and maybe macports?) For the .
Also the file BOOTLOG is dated 3/Nov/2012 with lots of entries for SlingShot, SlingShotUpdateProgressUI, NetworkFinishOSRSHostInfoLookup.
Can anybody explain these artifacts as natural occurrences (i.e., not the result of tampering)? Any suggestions as to other things to check to see whether my machine is infected?
Finally, could someone check the MD5 checksums for the following files:
/Volumes/efi/EFI/APPLE/EXTENSIONS/Firmware.scap 5783b82bc1dd7d612ca0447b737b35df /Volumes/efi/EFI/APPLE/FIRMWARE/2011MBP15.smc fbc25d6db9babda6d5d70163c9a48286 /Volumes/efi/EFI/APPLE/FIRMWARE/SmcFlasher.efi 586e3e4775cedb3a5ca821011541b500