Hashcat - APFS – FileVault 2 - Looking for assurances!

[Zen6]

I'm sorry, this is my mistake. 
1) Yes, brand new MacBook Air with Intel CPU. I mean macOS 11 and not OS X 10.11. My bad.
2) Yes, this MacBook Air has a T2 chip.
3) It is an APFS filesystem. For the first dump I use Macquisiton 2020.1 and opened the raw file inside X-Ways Forensics. I think the first dump was corrupted. I make a new one inside macOS 10.15 over TDM.
4) I need to dd dump with no error,sync the physical drive (disk2), right? Or I need the synthesized (disk3) one?
5) Yes, i build Frome source but at fvdetools/fvdeinfo i get the "unsupported storage signature" error. Same in The-Distribution-Which-Does-Not-Handle-OpenCL-Well (Kali) Linux (5.9) as in macOS 10.15
6) I'm sorry, I don't want to hijack his post. For me was this the same topic.

Here the output of diskutil apfs list

Code:

(snip) +-- Container disk3 XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX     ====================================================     APFS Container Reference:    disk3     Size (Capacity Ceiling):      250685575168 B (250.7 GB)     Capacity In Use By Volumes:  87167000576 B (87.2 GB) (34.8% used)     Capacity Not Allocated:      163518574592 B (163.5 GB) (65.2% free)     |     +-< Physical Store disk2s2 XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX     |  -----------------------------------------------------------     |  APFS Physical Store Disk:  disk2s2     |  Size:                      250685575168 B (250.7 GB)     |     +-> Volume disk3s1 XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX     |  ---------------------------------------------------     |  APFS Volume Disk (Role):  disk3s1 (System)     |  Name:                      Macintosh HD (Case-insensitive)     |  Mount Point:              Not Mounted     |  Capacity Consumed:        10965684224 B (11.0 GB)     |  FileVault:                Yes (Locked)     |     +-> Volume disk3s2 XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX     |  ---------------------------------------------------     |  APFS Volume Disk (Role):  disk3s2 (Data)     |  Name:                      Macintosh HD - Data (Case-insensitive)     |  Mount Point:              Not Mounted     |  Capacity Consumed:        72217112576 B (72.2 GB)     |  FileVault:                Yes (Locked)     |     +-> Volume disk3s3 XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX     |  ---------------------------------------------------     |  APFS Volume Disk (Role):  disk3s3 (Preboot)     |  Name:                      Preboot (Case-insensitive)     |  Mount Point:              Not Mounted     |  Capacity Consumed:        82440192 B (82.4 MB)     |  FileVault:                No     |     +-> Volume disk3s4 XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX     |  ---------------------------------------------------     |  APFS Volume Disk (Role):  disk3s4 (Recovery)     |  Name:                      Recovery (Case-insensitive)     |  Mount Point:              Not Mounted     |  Capacity Consumed:        542101504 B (542.1 MB)     |  FileVault:                No     |     +-> Volume disk3s5 XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX         ---------------------------------------------------         APFS Volume Disk (Role):  disk3s5 (VM)         Name:                      VM (Case-insensitive)         Mount Point:              Not Mounted         Capacity Consumed:        3221245952 B (3.2 GB)         FileVault:                No (Encrypted at rest)

Attampts to image :
1. try

Code:

dd if=/dev/disk2 of=disk.dd conv=noerror,sync

2. try

Code:

dd if=/dev/disk3 of=/disk.dd conv=noerror,sync bs=4m

Both times i get "Initialization of KeyManager failed."
See this issue in the upstream repro of apfs-fuse:
https://github.com/sgan81/apfs-fuse/issues/133

I think, apfs-fuse don't handle the 4k block size very well. I'm currently analyze the source of apfs-fuse to get an idea, what kind of error causes the "Initialization of KeyManager failed." error massage.

On macOS 10.15.5 i build https://github.com/kholia/fvde2john and get the same error:

Code:

sudo ./bin/apfs-dump-quick /dev/disk3 hash.txt st_mode = 24864 Sector count = 61202533 Sector size  = 4096 Device /dev/disk3 opened. Size is 250685575168 starting LoadKeybag Initialization of KeyManager failed. Unable to init container.