Frequently Asked Question

RECON Imager reporting dates on or around April 1, 1976
Last Updated 5 months ago

The Problem

After imaging a MacOS device from bootable media (such as RECON Imager), timestamps for the resulting image file(s) appear inaccurate and are reporting dates on or around April 1, 1976.

The Cause

After substantial testing, it is believed that this behavior is likely a function of the MacOS Recovery Mode / RecoveryOS.

When the Mac device has been powered off for some time, and the internal battery dies, the internal clock can no longer retain the current time and the date will revert to Unix EPOCH time (January 1, 1970). If you log in to a MacOS device without an active internet connection, the user will see this date after the clock has been reset, along with a warning notification from MacOS that the current system date seems incorrect and to connect or update the system clock.

When a Mac in this state is booted to RecoveryOS (either built into the Mac or from boot media) the date will be modified during startup (while you still see the Apple Logo with the progress bar beneath it). This process sets any system clock date prior to April 1, 1976 to April 1, 1976. Interestingly, this is the date that Apple was founded.

There is very little documentation of this online, but it is assumed this change is to prevent any date math from preceding the founding of Apple Computers.

Steps That Can Be Taken

With an understanding of cause, many users might be comfortable with these time and date stamps being present on the resulting image file(s). In which case, no action is necessary.

Other users might want to correct the system clock to the current date and time before proceeding with imaging. Users would do this knowing that they are making a correction to the system clock date and time and would typically note down the reported time, the current time, and the reason for making the change.

Currently, there is no way to set the system clock from within the RECON Imager application. Likewise, not all of the RECON Imager boot modes will allow the user to run tools other than Imager.

The system clock can be changed/updated from within the terminal either when logged in to MacOS on the live system or when logged in to the native RecoveryOS on the Mac device.

To set the date to the current date and time:

  1. First, enter Recovery Mode on the Mac Device:
    1. If it is an Intel Mac - hold down the Command-R (⌘-R) keys during startup to bring up the Recovery Mode boot menu.
    2. If it is a Silicon (M1, M2, or M3) Mac - hold down the Power (⏻) button during startup to bring up the "loading boot options" message (then you can release the power button). Once the menu of options comes up, select "Settings" to bring up the Recovery Mode boot menu.
  2. Select an administrative user that you have the password for and enter the password to access the Recovery Tools.
  3. From RecoveryOS you can access the terminal by clicking on Utilities > Terminal from the top menubar.
  4. In the Terminal window, you can use the date command and specify a date to use. For example: date 120100002023.00 (will set the date to December 1st, 2023 at 00:00 UTC). See the cheatsheet below to assist with crafting the right “date” command to use.

Date Command Cheat Sheet

The date command accepts dates using the following format: MMDDhhmmYYYY.ss

Code Meaning Accepted Values
MM Month 01-12
DD Day 01-31
hh Hours 00-23
mm Minutes 00-59
YYYY Year 1970-2038
ss Seconds 00-59

* All times will be set as UTC.

Please Wait!

Please wait... it will take a second!