Mari DeGrazia continues her Mac imaging series. This time she covers how to mount and work with FileVault2 encrypted Mac images.
According to Mari, you’ll need three things:
1) A full disk image of the encrypted system in raw format
2) The SIFT Workstation
3) The password or recovery key for the volume
Here is the link to full article.
DISCLAIMER: THIS POST IS FOR INFORMATIONAL PURPOSES ONLY AND IS NOT TO BE CONSIDERED LEGAL ADVICE ON ANY SUBJECT MATTER. DIGITAL FORENSICS CORP. IS NOT A LAWFIRM AND DOES NOT PROVIDE LEGAL ADVICE OR SERVICES. By viewing posts, the reader understands there is no attorney-client relationship, the post should not be used as a substitute for legal advice from a licensed professional attorney, and readers are urged to consult their own legal counsel on any specific legal questions concerning a specific situation.
