hashcat Forum

Hey Folks,

So. I've got an image of an old drive from my old Mac which has some files on it I would like to get back, the machine is around 11 or so years old now.

I tried to recover it using TestDisk and PhotoRec but the file partition itself is encrypted.

Has anyone had to deal with this before? Or does anyone recommend a good place to start?



Thanks

This should get you started: https://tinyapps.org/docs/cracking-filevault.html

(12-01-2021, 08:19 PM)pdo Wrote: [ -> ]This should get you started: https://tinyapps.org/docs/cracking-filevault.html

Thanks a lot pdo! That looks promising!

Please be advised that CoreStorage-technology from Apple is NOT the same as encryption.
When examining CoreStorage on a Windows-machine (based on your screenshot), it gives the impression to be encrypted but it is not.

Make sure you examine the .img on a Mac, and determine over there if encryption is activated or not.