FileVault encrypted...
 
Notifications
Clear all

FileVault encrypted MacBook on but locked

4 Posts
2 Users
0 Likes
315 Views
(@wotsits)
Posts: 253
Reputable Member
Topic starter
 

It appears the MacBook is on and decrypted past the initial screen that asks for the FileVault password when you turn it on for the first time after a shut down. But it has been allowed to lock from inactivity and requires the password.

If my understanding is correct then it is still decrypted and there should be some way to extract the encryption key - I would know how to do this in a Windows computer but not a Mac. I don't want to turn it off and image the hard drive yet as this might be the only chance to obtain the encryption key.

Can anyone shine any light on what to do in this situation? Or is it not possible to obtain the key unless fully logged on in a Mac?

 
Posted : 27/12/2016 8:19 pm
jaclaz
(@jaclaz)
Posts: 5133
Illustrious Member
 

http//www.forensicfocus.com/Forums/viewtopic/p=6586535/#6586535

jaclaz

 
Posted : 27/12/2016 9:41 pm
(@wotsits)
Posts: 253
Reputable Member
Topic starter
 

http//www.forensicfocus.com/Forums/viewtopic/p=6586535/#6586535

jaclaz

Thank you for bringing this to my attention.

The post refers to patches in the December 2016 update. Keeping in mind that this is a recently acquired device and could have all the latest updates, does that mean that the method described is no longer possible on machines updated post this December?

If so, do any other methods exist? I'd be quite embarrassed to request $300 for a piece of equipment that no longer does the job.

 
Posted : 28/12/2016 8:30 pm
jaclaz
(@jaclaz)
Posts: 5133
Illustrious Member
 

The post refers to patches in the December 2016 update. Keeping in mind that this is a recently acquired device and could have all the latest updates, does that mean that the method described is no longer possible on machines updated post this December?

Yes. very likely it won't work anymore

December 13th Apple released macOS 10.12.2 which contains the security update. At least for some hardware - like my MacBook Air.

If so, do any other methods exist? I'd be quite embarrassed to request $300 for a piece of equipment that no longer does the job.

Not that I know of.

jaclaz

 
Posted : 28/12/2016 10:13 pm
Share: