Apple Filevault issue

Data recovery from Hard Disk Drives with logical problems

Moderator: Nick_TS


Continuum
New user
Posts: 94
Joined: 02.04.09
Reputation: 2 / (20)

Apple Filevault issue

Postby Continuum » 14.10.23, 07:03

I have a drive with apply fielvault on it, but the recovery partition has bad sectors in the catalogue file.

Does anyone know the hex from the beginning of the EncryptedRoot.plist.wipekey file, and if so, how big is it, so I can just extract it if it exists on the partition without a catalogue reference.

User avatar
Doomer
New user
Posts: 135
Joined: 24.06.14
Reputation: 4 / (43)

Re: Apple Filevault issue

Postby Doomer » 16.10.23, 16:37

it's encrypted, so the hex depends on the encryption key


Continuum
New user
Posts: 94
Joined: 02.04.09
Reputation: 2 / (20)

Re: Apple Filevault issue

Postby Continuum » 16.10.23, 23:23

So the encryption key is also encrypted?

User avatar
300ddr
User
Posts: 263
Joined: 18.01.12
Reputation: 3 / (34)

Re: Apple Filevault issue

Postby 300ddr » 17.10.23, 19:42

DE can find wipekey in raw scan, I believe.


Continuum
New user
Posts: 94
Joined: 02.04.09
Reputation: 2 / (20)

Re: Apple Filevault issue

Postby Continuum » 18.10.23, 01:17

That is what I thought, but I cannot find it in my raw reference book. Any idea what it is called?

User avatar
300ddr
User
Posts: 263
Joined: 18.01.12
Reputation: 3 / (34)

Re: Apple Filevault issue

Postby 300ddr » 18.10.23, 01:50

I'm sorry, but I don't have the information readily available.


Return to “Data Extractor”

Who is online

Users browsing this forum: No registered users and 17 guests