0

I didn't have physical access to my machine (2008 macbook unibody 5,1, el capitan) and found out it had been tampered with (files destroyed on unencrypted hd). The missing files were 'only' artwork/writings and basic operation seems to still work. I was going to reinstall everything but realized about the recovery partition and boot process being able to be altered. I was wondering if I could get an md5 hash of the recovery/hidden partition and compare against a known good copy. I don't use time machine and haven't written to the recovery partition that I know of.

EDIT: I can obtain an md5 hash of my own, but I am not sure if it should be unique/alterable, and if so I need a known good hash to compare.

  • I would think that Apple would bake the same recovery partition, but to test it you would have to access the same mac model with the same OS X version to compare hashes between the two. If you are really worried, I recommend purchasing a retail disk of OS X and wiping all partitions of the disk and re-installing. This way you wouldn't have to worry about hashes, and is the easiest option if you want to be fully sure its safe. – QuickishFM Jan 18 at 21:26
  • @QuickishFM, Yeah I am trying to call some tech shops to see if they will give me a hash off the same model. I thought Apple might supply but I can't find it online. It occurred to me while working on this, that even though I have been the only owner of this machine and purchased it new, there is pretty much no hope of ever even being able to even speak to an actual Apple employee. – crazyfox Jan 18 at 21:32
  • I'll be honest, this is the first case of hashing a partition that I've seen, even though its understandable. To find out if the partitions are all the same, you'll need hashes from different machines (to make sure its not unique to each model), if they are willing to co-operate at all. If you can confirm that a retail DVD of Mac OS X will replace the recovery partition, then I think its the best way to get it back to 'vanilla' recovery partition, unless you want evidence that it was tampered with. – QuickishFM Jan 18 at 21:38
  • I don't think the hash of the entire volume will match, even between "identical" computers running the same macOS version -- the volume includes things like file timestamps, that are likely to depend on e.g. the exact time the system was installed (& the recovery partition created). How about starting from Internet Recovery (Option-Command-R instead of just Command-R)? That way, you're booting directly from an Apple server. You could then completely wipe the internal HD (including Recovery) and reinstall from scratch. – Gordon Davisson Jan 19 at 1:52

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Browse other questions tagged or ask your own question.