Join Us!

Apple Wipekey Recov...
 
Notifications
Clear all

Apple Wipekey Recovery  

  RSS
4Rensics
(@4rensics)
Active Member

Hi,

I'm trying to run a image from an old MacBook Pro through AXIOM. Its asking for a .wipekey file from the recovery folder.

I have the image and X-Ways lets me see everything unencrypted, but AXIOM is asking for a key / password to decrypt the HFS+ partition. I can see where the Wipekey (kind of is) but its not an actual file and if I recover it, its 0kb in size.

Is this file encrypted? Is there a way to get it out?

I'm a little confused!

Thanks,
4F

Quote
Posted : 03/02/2020 2:01 pm
AmNe5iA
(@amne5ia)
Active Member

It's a bug with the Passware plugin with Axiom. Before processing it you need to uncheck the "Passware Encryption Features" option from the setting menu.

ReplyQuote
Posted : 03/02/2020 2:45 pm
4Rensics
(@4rensics)
Active Member

It's a bug with the Passware plugin with Axiom. Before processing it you need to uncheck the "Passware Encryption Features" option from the setting menu.

WOW. THANK YOU VERY MUCH!

A life safer. I would have been here all day googling and losing the will to live trying to figure out why its not encrypted but its encrypted! lol

I've ticked it off and its processing now.

Thanks again,
4R

ReplyQuote
Posted : 03/02/2020 3:03 pm
Share: