STEP 1: Use dd to extract image of your targets FileVault2 encrypted disk:
sudo dd if=/dev/disk2 of=/path/to/filevault_image.dd
conv = noerr, sync
STEP 2: Install fvde2john from Here
STEP 3: Use hdiutil to attach to dd image:
hdiutil attach -imagekey diskimage-class=CRawDiskImage -nomount /Volumes/path/to/filevault_image.dd
STEP 4: Obtain the EncryptedRoot.plist.wipekey from "Recovery HD" partition
https://github.com/libyal/libfvde/wiki/Mounting#obtaining-encryptedrootplistwipekey
mmls /Volumes/path/to/filevault_image.dd
fls -r -o 50450752 /Volumes/path/to/filevault_image.dd | grep -i EncryptedRoot
icat -o 50450752 image.raw 130 > EncryptedRoot.plist.wipekey
STEP 5: Verify and note the disk mount point for Apple_Corestorage:
diskutil list
.../dev/disk3s2 Apple_Corestorage
STEP 6: Use EncryptedRoot.plist.wipekey with fvdeinfo to retrieve the hash:
sudo fvdetools/fvdeinfo -e EncryptedRoot.plist.wipekey -p blablah /dev/disk3s2
Will return hash
FINAL STEP: Load this hash into JTR or Hashcat to crack it:
john --format=FVDE-opencl --wordlist=dict.txt hash.txt
hashcat -a 0 -m 16700 hash.txt dict.txt
Ignore/keyword
Keyword
encryption management for apple filevault
filevault 2 encryption
encryption management for apple filevault will damage your computer
uninstall encryption management for apple filevault
filevault 2 encryption algorithm
filevault 2 encryption strength
filevault 2 encryption jamf
filevault 2 encryption will be turned on
filevault 2 encryption fdesetup
filevault 2 encrypt external drive
filevault 2 encrypted only home folder
filevault 2 partition encryption state
encryption management for apple filevault will damage your computer. you should move it to the trash
filevault 2 partition encryption state not encrypted
filevault 2 encryption
filevault hack
filevault mac encryption
filevault 2 encryption algorithm
filevault 2 encryption strength
filevault 2 encryption jamf
filevault 2 encryption will be turned on
filevault 2 encryption fdesetup
filevault 2 encrypt external drive
filevault 2 encrypted only home folder
filevault 2 partition encryption state
filevault hackintosh
filevault hackintosh catalina
filevault hackintosh mojave
filevault hackintosh high sierra
hackintosh filevault cannot boot
hackintosh filevault preboot
hackintosh filevault keyboard not working
hackintosh filevault 2 catalina
mac filevault encryption paused
mac filevault encryption stuck
mac filevault encryption taking a long time
mac filevault encryption bypass
mac filevault encryption time
mac filevault encryption algorithm
mac filevault encryption key
mac filevault encrypted disk
filevault 2 partition encryption state not encrypted
filevault hackintosh catalina
filevault hackintosh mojave
filevault hackintosh high sierra
hackintosh filevault cannot boot
hackintosh filevault preboot
hackintosh filevault keyboard not working
hackintosh filevault 2 catalina
hackintosh filevault black screen
hackintosh filevault 2 catalina
hackintosh filevault 2 mojave
mac filevault encryption taking a long time
mac filevault recovery key icloud
mac filevault recovery key not working
mac filevault get recovery key
mac change filevault recovery key
mac use filevault recovery key
filevault disk encryption mac
osx filevault disk encryption
mac filevault vs disk encryption
new mac filevault disk encryption
mac filevault recovery key has been set
mac filevault recovery key icloud
mac filevault recovery key not working
mac filevault recovery key
mac filevault recovery key icloud
mac filevault recovery key not working
filevault disk encryption mac yes or no
filevault disk encryption mac performance
filevault disk encryption mac reddit
filevault disk encryption mac how long does it take
filevault disk encryption osx
macos filevault disk encryption
does filevault disk encryption slow down mac
mac filevault vs disk encryption
mac filevault disk encryption
mac filevault vs disk encryption
new mac filevault disk encryption
mac filevault disk encryption
mac filevault disk encryption
mac filevault recovery key not working
mac filevault recovery key icloud
mac change filevault recovery key
mac use filevault recovery key
filevault disk encryption mac how long does it take
filevault disk encryption mac
filevault disk encryption apple
filevault disk encryption mac yes or no
filevault disk encryption mac how long does it take
filevault disk encryption mac performance
filevault disk encryption mac คืà¸
osx filevault disk encryption
macbook pro filevault disk encryption
osx filevault disk encryption
mac filevault vs disk encryption
new mac filevault disk encryption
mac stuck on filevault disk encryption
mac frozen on filevault disk encryption
filevault disk encryption mac how long does it take
filevault disk encryption mac performance
filevault disk encryption mac คืà¸
apple filevault disk encryption review
apple filevault disk encryption performance
new macbook pro filevault disk encryption
macbook pro stuck on filevault disk encryption
mac frozen on filevault disk encryption
mac stuck on filevault disk encryption
macbook pro filevault disk encryption
Comments
Post a Comment