PC-3000 Forum

What is the proper sequence here:

1.image the whole drive
2.clone data to drive and read it with any mac
3.input the password for File vault to get the files

Is this the correct order?

No.
PC3000 supports FileVault decryption on the fly.
You can find blog post from Ace and follow instructions.
It works pretty good.

what's the point of decrypting on the fly if you still have to image the entire drive due to corestorage?
You would have to image the entire volume because of that, correct?

Decrypting on the fly lets you image only needed data, so less stress to a weak drive.

digitalsupport, yes i know that, but with core storage, my understanding is that you have to image the entire drive first to see anything at all, regardless of decrypting filevault on the fly or not. Is that not your experience ?

My point is that file vault (and how/when you deal with it) is not the real problem here. Core storage is the real dilemma here.

You can follow these steps:

1. Read MBR, GPT and HFS+ Volume header sectors to get FileVault partition map
2. Decrypt this partition using password or encryption key.
3. Read data you need based on Catalog file.

Please keep in mind that Fusion systems have the same signature. Don't mess them with FileVault.