Hi guys, im in charge of a mac network in a university, and recently i found that one of the imacs RAM was changed from 2x2GB cards to 2x1 GB ram cards. i just can figure some student who already owe a imac has done the job.
i need to find the date and hour in which the replacement was done so i can check the class lists and try to find who was in charge of that imac at that time.
does anyone know where to look at the logs? i need to know when this hardware was registered. please help.
Keep in mind there are hundreds of other logs that get made when the computer shuts down or powers on.
But doing a search for "systemShutdown" or "BOOT_TIME" would be where I would start looking.
But keep in mind that all for all the time you spend trying to track doen the kid to get the computer back to the 4 GB of ram is going to be probably less then $100 from crucial. So its up to you if its worth the time.