Encrypted Apple Core Storage Volume - I'm stuck

Encrypted Apple Core Storage Volume - I'm stuck - Printable Version

+- hashcat Forum (https://hashcat.net/forum)
+-- Forum: Misc (https://hashcat.net/forum/forum-15.html)
+--- Forum: General Talk (https://hashcat.net/forum/forum-33.html)
+--- Thread: Encrypted Apple Core Storage Volume - I'm stuck (/thread-10492.html)

Encrypted Apple Core Storage Volume - I'm stuck - HostileBlue2020 - 12-01-2021

Hey Folks,

So. I've got an image of an old drive from my old Mac which has some files on it I would like to get back, the machine is around 11 or so years old now.

I tried to recover it using TestDisk and PhotoRec but the file partition itself is encrypted.

Has anyone had to deal with this before? Or does anyone recommend a good place to start?

[Image: 20211129-initial-screen.png]

Thanks

RE: Encrypted Apple Core Storage Volume - I'm stuck - pdo - 12-01-2021

This should get you started: https://tinyapps.org/docs/cracking-filevault.html

RE: Encrypted Apple Core Storage Volume - I'm stuck - HostileBlue2020 - 12-01-2021

(12-01-2021, 08:19 PM)pdo Wrote: This should get you started: https://tinyapps.org/docs/cracking-filevault.html

Thanks a lot pdo! That looks promising!

RE: Encrypted Apple Core Storage Volume - I'm stuck - Banaanhangwagen - 12-02-2021

Please be advised that CoreStorage-technology from Apple is NOT the same as encryption.
When examining CoreStorage on a Windows-machine (based on your screenshot), it gives the impression to be encrypted but it is not.

Make sure you examine the .img on a Mac, and determine over there if encryption is activated or not.