For Experts: Finding Macbook Airport ID w/o the Macbook

Question

Hi Folks,
I'm hoping some OS X pros can help me with an unusual problem. A few days ago, my apartment was burglarized and my MacBook was stolen. Fortunately, the thief doesn't seem to be very computer savvy, as I've been able to track their activity online (Google Notifier is running in the background and I can track it with Gmail's "Last Account Activity" function). From that, I've found that they are using a local ATT dsl account IP; I've turned that info over to the police, but they don't seem eager to spend much energy on tracking my Macbook.
I have another idea, though. I highly suspect that the person who stole the Macbook is actually my upstairs neighbor (who had opportunity to break in and has a track record of being a jerk). If this is the case, or if the thief is anywhere nearby, I could use wifi sniffing to physically locate my Macbook. I've already logged several days worth of packet activity, but to find out whether any of it is coming from my system, I need the MAC address (or "Airport ID") of my Macbook. Logs from my router haven't been any help (it only stored ~2 days worth, and I didn't think of this idea until it was too late). However, I do have the hard drive of my Macbook backed up with TimeMachine, and I'm hoping that the MAC address is written to a configuration file or log file somewhere in there.
Anyone have an idea where I might find such a thing, either in OS X files or in common application files? Any other ideas on how to find the MAC address without having physical access to the machine, perhaps from iTunes sharing authorizations? I'd certainly appreciate any advice that Mac experts could offer, and know that you'll be helping to right an injustice!
Many Thanks,
David Hart

Answer 1

Okay, try this then. Mount your Time Machine partition and open a terminal at the root of that volume. Then try the following command
sudo grep -R -E '([a-fA-F0-9]{2}:){5}[a-fA-F0-9]{2}' *
the sudo is to try and look into as many files as possible. Now be warned, this is probably going to be quite time intensive and you might be best piping the results into a file in your home directory by adding to it with
sudo grep -R -E '([a-fA-F0-9]{2}:){5}[a-fA-F0-9]{2}' * > ~/macaddressresults.txt
That regular expression is looking for any instances of colon separated hexadecimals in every file, hence why it might take a while.