Try to guess the first Jamf Imaging of a machine - https://jamfnation.jamfsoftware.com/discussion.html?id=4120

firstrecon.sh

#!/bin/bash
declare -x awk="/usr/bin/awk"
declare -x date="/bin/date"
declare -x pkgutil="/usr/sbin/pkgutil"
declare -xi MANAGE_EPOCH="$($pkgutil --file-info  /usr/sbin/jamf |
                $awk '/install-time/{print $NF;exit}')"
declare -x  FIRST_BOOT_GUESS="$($date -r $MANAGE_EPOCH "+%Y-%m-%d %H:%M:%S")"

printf "<result>%s</result>\n" "$FIRST_BOOT_GUESS"