hashcat Forum

Full Version: Encrypted Apple Core Storage Volume - I'm stuck
You're currently viewing a stripped down version of our content. View the full version with proper formatting.
Hey Folks,

So. I've got an image of an old drive from my old Mac which has some files on it I would like to get back, the machine is around 11 or so years old now.

I tried to recover it using TestDisk and PhotoRec but the file partition itself is encrypted.

Has anyone had to deal with this before? Or does anyone recommend a good place to start?

[Image: 20211129-initial-screen.png]

Thanks
(12-01-2021, 08:19 PM)pdo Wrote: [ -> ]This should get you started: https://tinyapps.org/docs/cracking-filevault.html

Thanks a lot pdo! That looks promising!
Please be advised that CoreStorage-technology from Apple is NOT the same as encryption.
When examining CoreStorage on a Windows-machine (based on your screenshot), it gives the impression to be encrypted but it is not.

Make sure you examine the .img on a Mac, and determine over there if encryption is activated or not.