Resetting Password on Macintosh that is using OS X

If you will do a forensic investigate a Macintosh that is running OS X and you need to access a program on a booted forensic copy of the subject’s drive,and if you do not known the password. Follow the steps  below;

 If you have any version of the Macintosh OS X boot CD or DVD, place that in the examination system and hold

down the C key to boot from the CD/DVD drive.Then the system asks if you want to install/reinstall OS X, choose the Password Reset Utility from the drop-down menus at the top of the screen. You will be shown a list of users and you can pick one or all of them and change the password of the accounts to something you know.

 

Resource: The Official CHFI Study Guide (Exam 312-49) for Computer Hacking Forensic Investigators  Copyright © 2007 by Elsevier, Inc.