Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I have a 2011 Macbook Pro, running 10.8.2 and was worried that the laptop may have been tampered with while left unattended for a few days while abroad in Asia.

I have mounted my EFI partition using:

mkdir /Volumes/efi
sudo mount -t msdos /dev/disk0s1 /Volumes/efi

In there I have found:

├── .Trashes
│   ├── ._502
│   ├── ._508
│   ├── 502
│   └── 508
├── .fseventsd
│   └── fseventsd-uuid
├── BOOTLOG
└── EFI
    └── APPLE
        ├── CACHES
        ├── EXTENSIONS
        │   └── Firmware.scap
        └── FIRMWARE
            ├── 2011MBP15.smc
            └── SmcFlasher.efi

I repartitioned the computer and enabled filevault just before New Year's Eve 2013 and so thought it strange that the folder /Volumes/efi/.Trashes/._508 exists and is dated 2 Nov 2012. Also I don't recall ever having had a user with id as high as 508. (Only have 3 accounts and maybe macports?) For the .

Also the file BOOTLOG is dated 3/Nov/2012 with lots of entries for SlingShot, SlingShotUpdateProgressUI, NetworkFinishOSRSHostInfoLookup.

Can anybody explain these artifacts as natural occurrences (i.e., not the result of tampering)? Any suggestions as to other things to check to see whether my machine is infected?

Finally, could someone check the MD5 checksums for the following files:

/Volumes/efi/EFI/APPLE/EXTENSIONS/Firmware.scap 5783b82bc1dd7d612ca0447b737b35df
/Volumes/efi/EFI/APPLE/FIRMWARE/2011MBP15.smc   fbc25d6db9babda6d5d70163c9a48286
/Volumes/efi/EFI/APPLE/FIRMWARE/SmcFlasher.efi  586e3e4775cedb3a5ca821011541b500
share|improve this question
    
Could you add your operating system, currently you state you are running "10.8.2" but you don't specify what OS. –  washbow Mar 13 '13 at 0:04
1  
@washbow: A "2011 Macbook Pro, running 10.8.2" would most likely indicate OS X Mountain Lion. –  Karan Mar 13 '13 at 3:55
    
Yup running Mountain Lion –  WorriedAboutEFI Mar 13 '13 at 12:52
add comment

1 Answer

EFI stands for Extensible Firmware Interface, it's has some of the functionalities your BIOS used to have on old computers. The filesystem contains the files, that extent the functionality of the EFI. In this case it contains the bootloader to start up Mac OS X.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.