Apple Wipekey Recov...
 
Notifications
Clear all

Apple Wipekey Recovery

3 Posts
2 Users
0 Likes
1,476 Views
4Rensics
(@4rensics)
Posts: 255
Reputable Member
Topic starter
 

Hi,

I'm trying to run a image from an old MacBook Pro through AXIOM. Its asking for a .wipekey file from the recovery folder.

I have the image and X-Ways lets me see everything unencrypted, but AXIOM is asking for a key / password to decrypt the HFS+ partition. I can see where the Wipekey (kind of is) but its not an actual file and if I recover it, its 0kb in size.

Is this file encrypted? Is there a way to get it out?

I'm a little confused!

Thanks,
4F

 
Posted : 03/02/2020 2:01 pm
AmNe5iA
(@amne5ia)
Posts: 173
Estimable Member
 

It's a bug with the Passware plugin with Axiom. Before processing it you need to uncheck the "Passware Encryption Features" option from the setting menu.

 
Posted : 03/02/2020 2:45 pm
4Rensics
(@4rensics)
Posts: 255
Reputable Member
Topic starter
 

It's a bug with the Passware plugin with Axiom. Before processing it you need to uncheck the "Passware Encryption Features" option from the setting menu.

WOW. THANK YOU VERY MUCH!

A life safer. I would have been here all day googling and losing the will to live trying to figure out why its not encrypted but its encrypted! lol

I've ticked it off and its processing now.

Thanks again,
4R

 
Posted : 03/02/2020 3:03 pm
Share: