How can I verify if my MacBook was shut off and not used during repair?

Question

Level 1

4 points

How can I verify if my MacBook was shut off and not used during repair?

I sent my Macbook Pro 14-inch, 2021 with macOS 15.3.2 (24D81) to repair because I had dropped liquid on the trackpad.

They asked me for the login password to be able to test it: I didn't want to give it so we tried to create another user account, but the keyboard & screen were not functioning correctly (even with external peripheries given by them) and I was being logged-off continuously, so after trying for 20 minutes I was feeling bad for them and I left my password.

As soon as I left I became paranoid as you can imagine.. as there are many saved passwords on this macbook. Today I finally got my hands back on my macbook, and I want to check if it was used with my (administrator) user.

ScreenTime reported no activity during the repair days other than the day I was at the shop (but the usage time could be longer than what I used it myself), but then I noticed that during the days before I got it back, there were 24 Pickups per day. That seems weird because during other days when I was using the mac myself there is no baseline like that (for example there are some nights with no pickups - I imagine because I shut it off). So how could it record a pickup every hour? Are there specific apps that do that automatically? Could it be a bug? They were supposed to disassemble my macbook, hence shut it off I guess.. Could it be that they always left it in sleep mode? (my macbook wasn't repaired and I'm still using it with external mouse & keyboard, as I wanted it back while they wait for the shipment of the trackpad component - so it could even be that they didn't even open it to repair) Could it be that they erased the data and put this bogus hourly data?

I then also checked the `last` command from the Terminal: before I restarted my mac myself I was seeing two lines with "still logged in", one with current date and one with the date I gave my mac to the repair shop. After shutting down the mac and logging back in, the line from that date didn't show the "still logged in" anymore but an end time of ~2 hours after I left the shop. How is the `last` command working? I guess its output can also be manipulated by the admin user.. so is the fact that there was a "still logged in" an indication of manipulation? How else can I check if my macbook was shut off and/or used?

[Re-Titled by Moderator]

MacBook Pro 14″, macOS 15.3

Posted on Mar 27, 2025 2:25 PM

Reply

Answer 1

Mar 27, 2025 3:28 PM in response to kopeboy

kopeboy wrote:

I sent my Macbook Pro 14-inch, 2021 with macOS 15.3.2 (24D81) to repair because I had dropped liquid on the trackpad.

They asked me for the login password to be able to test it: I didn't want to give it so we tried to create another user account, but the keyboard & screen were not functioning correctly (even with external peripheries given by them) and I was being logged-off continuously, so after trying for 20 minutes I was feeling bad for them and I left my password.

As soon as I left I became paranoid as you can imagine.. as there are many saved passwords on this macbook. Today I finally got my hands back on my macbook, and I want to check if it was used with my (administrator) user.

[Re-Titled by Moderator]

Dropped it off where for repair, a back alley...?

Hardware repair —I have never once heard of repair people taking a joy ride on repair inventory & scouring the bowels of a machine for personal details...

if you still have an issue with the trackpad take it back.

Reply

Answer 2

HWTech

Level 9

63,692 points

Mar 28, 2025 8:46 PM in response to kopeboy

People should never, ever give out their passwords to anyone. Apple should no longer ask for any user passwords in order to protect user privacy & data/information, as well as protecting Apple staff & AASP techs from claims of reading/distributing any of the user's personal files. If Apple/AASP doesn't have the password, then there is no way they can see or distribute your personal files which protects them legally as well and keeps you safe as well.

While you are with the Apple tech who is examining the device trying to look at software issues & logs, they can ask you to unlock the device, but they are required to have you standing there with them so you can watch everything they do so you know they are not looking at or copying your files. They should not be alone with your unlocked device these days.

Of course this means that an Apple tech will likely need to perform a clean install of macOS in order to troubleshoot the device since they should not have any admin passwords for the device since all the new privacy & security features require admin authentication for almost everything. This also means the user is 100% responsible for maintaining good backups, or the user will end up losing their data. Apple no longer backs up user data, plus it is nearly impossible to backup data once an issue arrises these days.

If this is an Apple Store or an Apple Authorized Service Provider, then I would report them to Apple corporate for asking for your password so Apple can investigate.

Reply

Quick Links

How can I verify if my MacBook was shut off and not used during repair?