How to
Now Reading
Mounting and Reimaging an Encrypted FileVault2 Mac Image in Linux
0

Mounting and Reimaging an Encrypted FileVault2 Mac Image in Linux

Mari DeGrazia continues her Mac imaging series. This time she covers how to mount and work with FileVault2 encrypted Mac images.

According to Mari, you’ll need three things:

1) A full disk image of the encrypted system in raw format
2) The SIFT Workstation
3) The password or recovery key for the volume

tux_filevault_forensics

Here is the link to full article.

Leave a Response


Please enter the result of the calculation above.