Hashcat - APFS – FileVault 2 - Looking for assurances!
#4
1) Are you sure that it's a 2020 Macbook Air with the old 10.11 (from 2015) on it ? Sounds not impossible but it's a little bit weird, no?
2) To be sure, please mention the model number as found on the back. With this number you can check online if the laptop is equipped with T2 or not.
3) What filesystem does it have ? Since you are talking about 'EncryptedRoot.plist.wipekey', I assume it's HFS. Since you are talking about T2, it will be APFS. What is it now ?
4) If you successfully connect your laptop with TDM, make sure to identify the correct disk to image with 'diskutil cs list' (again: assumings it's HFS) for apfs use: 'diskutil apfs list'.
5) Did you follow this guide in order to recover the hash ? (note: you won't need to attach an image here, TDM does it automatically)
and 6) in the future, please do not hijack existing posts, but simply create a new one
Reply


Messages In This Thread
RE: Hashcat - APFS – FileVault 2 - Looking for assurances! - by Banaanhangwagen - 12-07-2020, 10:50 PM