±Forensic Focus Partners

Become an advertising partner

±Your Account


Username
Password

Forgotten password/username?

Site Members:

New Today: 0 Overall: 35875
New Yesterday: 3 Visitors: 142

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

±Latest Videos

±Latest Jobs

How to extract the hashes for decryption of Macbook disk?

Computer forensics discussion. Please ensure that your post is not better suited to one of the forums below (if it is, please post it there instead!)
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
 
  

doublezero
Newbie
 

How to extract the hashes for decryption of Macbook disk?

Post Posted: Apr 17, 19 15:47

Hey guys.

I'm working in a case where we have a Macbook encrypted (AES-XTS), and we dont have the recovery key or password, but I was able to recover the EncryptedRoot.plist.wipekey. I found some info on how to recover the hashes for using with hashcat (https://hashcat.net/forum/thread-7620.html?highlight=filevault) but I was unable to reproduce the results in our lab.

Anyone with experience working with encrypted mac devices?

Thank you!  
 

Page 1 of 1