hashcat Forum › Misc › General Talk v
Encrypted Apple Core Storage Volume - I'm stuck

Threaded Mode
Encrypted Apple Core Storage Volume - I'm stuck
HostileBlue2020 Offline
Junior Member
**
Posts: 16
Threads: 6
Joined: Sep 2021
#1
Question  12-01-2021, 08:15 PM
Hey Folks,

So. I've got an image of an old drive from my old Mac which has some files on it I would like to get back, the machine is around 11 or so years old now.

I tried to recover it using TestDisk and PhotoRec but the file partition itself is encrypted.

Has anyone had to deal with this before? Or does anyone recommend a good place to start?

[Image: 20211129-initial-screen.png]

Thanks
Find
Reply
pdo Offline
Member
***
Posts: 64
Threads: 1
Joined: Mar 2017
#2
12-01-2021, 08:19 PM
This should get you started: https://tinyapps.org/docs/cracking-filevault.html
Find
Reply
HostileBlue2020 Offline
Junior Member
**
Posts: 16
Threads: 6
Joined: Sep 2021
#3
12-01-2021, 08:31 PM
(12-01-2021, 08:19 PM)pdo Wrote: This should get you started: https://tinyapps.org/docs/cracking-filevault.html

Thanks a lot pdo! That looks promising!
Find
Reply
Banaanhangwagen Offline
Member
***
Posts: 165
Threads: 5
Joined: Mar 2018
#4
12-02-2021, 11:58 AM
Please be advised that CoreStorage-technology from Apple is NOT the same as encryption.
When examining CoreStorage on a Windows-machine (based on your screenshot), it gives the impression to be encrypted but it is not.

Make sure you examine the .img on a Mac, and determine over there if encryption is activated or not.
Find
Reply