Contents
Is it possible to decrypt a FileVault 2 volume?
Not only will a user password allow accessing their Mac, but it will also allow decrypting FileVault 2 volumes that are otherwise securely encrypted with virtually unbreakable XTS-AES. FileVault 2 is Apple’s take on whole-disk encryption. Protecting the entire startup partition, FileVault 2 volumes can be unlocked with either of the following:
How to attack a FileVault 2 password with ElcomSoft?
In order to attack a FileVault 2 password with Elcomsoft Distributed Password Recovery, perform the following steps. Make an image of the hard drive (physical device) or an image of the encrypted partition and save it into a file. The following formats can be used: Raw disk image (.dd), EnCase image file (.e01), Apple Disk Image (.dmg).
Is there a way to unlock FileVault 2?
If this is the case, each user must type their password before they will be able to unlock the disk. In order for other users to be able to unlock FileVault 2, one has to click Enable User and enter the user’s password while setting up encryption (or any time after).
Can a FireWire attack be run on FileVault 2?
In order to recover these keys, one would need to dump the content of the computer’s RAM into a file. Note that it is no longer possible to run a FireWire attack on locked or sleeping Macs due to Mac OS X security restrictions, so the RAM capturing tool must be executed on a running computer with FileVault 2 container unlocked and a user logged in.
What is the recovery key for FileVault 2?
Once FileVault 2 is enabled, the system creates and displays a recovery key. According to http://eprint.iacr.org/2012/374.pdf, the recovery key contains 120 bits (we didn’t check) that are encoded with all letters and numbers 1 through 9, and formatted to look like this: The user has an option to store the key with Apple.
How to decrypt FileVault volume in ElcomSoft phone breaker?
Select “Decrypt FileVault image”. Specify path to the forensic image of the encrypted volume. Elcomsoft Phone Breaker accepts raw disk images (.dd), EnCase image files (.e01), and Apple Disk Images (.dmg).