±Forensic Focus Partners

Become an advertising partner

±Your Account


Username
Password

Forgotten password/username?

Site Members:

New Today: 2 Overall: 36767
New Yesterday: 4 Visitors: 99

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

±Latest Videos

±Latest Jobs

X-Ways Does Not Process APFS!!

Forensic software discussion (commercial and open source/freeware). Strictly no advertising.
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
Page Previous  1, 2 
  

pbobby
Senior Member
 

Re: X-Ways Does Not Process APFS!!

Post Posted: Mar 02, 20 22:18

If your APFS volume is encrypted then XWays doesn't support and never will.

Stefan is either stubborn about encryption support or he cannot get licensed/authorized to for it.

I am an XWays user and use other software to handle disk encryption (namely Encase - hah. But it works very well).
_________________
Don't get baited. 
 
  

PensiveHike
Newbie
 

Re: X-Ways Does Not Process APFS!!

Post Posted: Mar 13, 20 15:50

Once you have processed the image files with Axiom, a decrypted image file should be present within the Axiom case file. This can then be loaded into X-Ways. For the time being, this is how we are doing it.

Initially we tried loading the encrypted image into Passware and creating a decrypted image file, but certain data (pictures) was missing, so we stopped doing it this way.  
 
  

Rich2005
Senior Member
 

Re: X-Ways Does Not Process APFS!!

Post Posted: Mar 13, 20 16:39

- PensiveHike
Once you have processed the image files with Axiom, a decrypted image file should be present within the Axiom case file. This can then be loaded into X-Ways. For the time being, this is how we are doing it.

Initially we tried loading the encrypted image into Passware and creating a decrypted image file, but certain data (pictures) was missing, so we stopped doing it this way.


Not sure whether his volume was encrypted in the end, however, just for the info of others, if you don't have Axiom, you can decrypt it using libfvde: mount it with fvdemount using the wipekey, and then acquire it (using ewfacquire for example).

I happen to have done a drive that way originally, and later via Axiom, and the hashes of the data were the same, just to confirm (dunno if they use the same library to do it - support haven't confirmed that or not).  
 

Page 2 of 2
Page Previous  1, 2