[rhodesy]

Hi,

If there was a new install of leopard on a computer would there be any way of finding out when it was last used by such things as the EFI? if so, how can I access that kind of information.

I'm dealign with a client who says they didn't use the laptop (not even turned it out) after a certain date and would like to check this.

Thanks a lot

Luke

[ibook_steve]

I guess you can look in the Console to see time stamps. I'm not sure what else you could do.

Steve

[peeb]

Would the filesystem logs have anything?

[bishopazrael]

As a tech, I've got to wonder why you're interested in proving this kind of thing? So the client says he hasn't been on his computer in x number of days/weeks/ etc... what does it matter? What's the underlying issue you're trying to fix?

Now ... if your an attorney or barrister, then thats another thing. You'll need to take it to a computer forensics' specialist and have them dump the hdd logs and such.

Telling us more about what you're doing would help us figure out how to get what you're after.

[besson3c]

/var/log/secure.log should contain login data, and you'll likely have some stuff in /var/log/messages and/or /var/log/system.log as well.