Extension Attribute for Casper Imaging

Dummy receipt. Create a package that does nothing, but can be searched for in the receipts.

- edited so I didn't sound rude -

So that'll be for any forthcoming Macs I image with Casper Imaging.

But what about the current one that have already been imaged and are out in the wild? Is there something I can capture during recon that can identify them as "built using Casper Imaging" ?

I believe the Casper Imaging log is held in the database, so I don't think you can use that as your "trigger". The only way would be what @ctangora suggested, to use a dummy receipt.

You could go through the Receipts folder in the JAMF folder and parse the dates of the files in that folder. You'd be looking for the oldest date, and that should be the date the machine was imaged.

I just re-read the original post. I don't know that you'd have any other way to identify that a machine was imaged with Casper without a dummy receipt.

You could head the jamf.log and grep for "adobeinstall", if you use the first-run script option (which who doesn't?).

Yes, i would go with writing an extension attribute that simply finds something unique to systems that were imaged with Casper Imaging, whatever that may be for you. The jamf.log is probably your best bet there.

Problem with using the jamf.log file is that it turns over, so if you are looking for machines that have been imaged 6 months ago, you may not see that in the jamf.log file.

I wouldn't grep the jamf log, because, as stevewood mentions, it can get cleared or turned over, removing the information you're looking for.
I would instead get the creation date for it. Even if the log gets wiped the creation date will remain the same until its actually deleted (or recreated somehow), which hopefully isn't happening unless its re-imaged.

#!/bin/sh

LOG="/var/log/jamf.log"

LOGDate=$( mdls -name kMDItemFSCreationDate "$LOG" | awk '{print $3,$4}' )

echo "<result>$LOGDate</result>"

That will give you a date in a proper date style format for Casper, such as 2013-01-15 10:15:00

Edit: Just to be clear, this will of course only get you the date the Mac was "enrolled" into Casper. That may be the imaging date, but it may not be, and won't really get you what you originally asked about; a way to distinguish between imaged Macs and ones that were not imaged, but enrolled.

Yeah, the log may roll-over, I figured it would at some point, but my log was at 7 months with no roll yet. Good to know that it eventually does. Great hint on the date though!

If you have a different imaging admin account from your quick-add account, you can also tell that way. It would be a lot easier also. If your imaging account was CASPER and your quick-add was REPSAC, then you could easily tell what machine was imaged and what was added in after.

Yep, if you happen to add in a specific account when imaging or some other element you know about, you could detect that in the script and also get its creation date using the same method as I mentioned. This would be a good basis for a "Imaged On Date" Extension Attribute.