Just as I've found the time to write up a blog post along comes an appropriate time related subject.
Recently I examined an Apple iMac running Mountain Lion. I was only given access to an image. This presented a problem because the matter under investigation relied on accurate time stamps and I had no system clock to check. I knew that by default Apple OS X (Snow Leopard through to Mavericks for certain and probably earlier versions) will Set date and time automatically whilst connected to the internet (to allow a connection to a network time server using Network Time Protocol [ntp] ) as shown in Figure 1.
The problem to overcome then was to establish where this setting was stored - I knew it would be in a plist somewhere - isn't everything Mac related stored in a plist? :-) So many plists so little time! A little bit of research and testing allowed me to determine exactly where the setting was stored and as a result share this with you. Figure 2 shows the overrides.plist in the Finder at the path /private/var/db/launchd.db/com.apple.launchd.
This plist is an xml plist so it can be read easily. Figure 3 shows this plist viewed with the Xcode Property List Editor.
The key we are interested in is the org.ntp.ntpd key. If the Disabled value is true Set date and time automatically is turned off.
Hope this helps someone.
Richard
Recently I examined an Apple iMac running Mountain Lion. I was only given access to an image. This presented a problem because the matter under investigation relied on accurate time stamps and I had no system clock to check. I knew that by default Apple OS X (Snow Leopard through to Mavericks for certain and probably earlier versions) will Set date and time automatically whilst connected to the internet (to allow a connection to a network time server using Network Time Protocol [ntp] ) as shown in Figure 1.
 |
| Figure 1 |
The problem to overcome then was to establish where this setting was stored - I knew it would be in a plist somewhere - isn't everything Mac related stored in a plist? :-) So many plists so little time! A little bit of research and testing allowed me to determine exactly where the setting was stored and as a result share this with you. Figure 2 shows the overrides.plist in the Finder at the path /private/var/db/launchd.db/com.apple.launchd.
 |
| Figure 2 |
This plist is an xml plist so it can be read easily. Figure 3 shows this plist viewed with the Xcode Property List Editor.
 |
| Figure 3 |
The key we are interested in is the org.ntp.ntpd key. If the Disabled value is true Set date and time automatically is turned off.
Hope this helps someone.
Richard
Posts
No comments:
Post a Comment