Notifications
Clear all
Topic starter
28/04/2024 11:06 am
Hi all
first post here and Im a real newb on forensics topics.
Playing a bit around with bulk_extractor Id like to use it with a clone image of an encrypted apfs drive. Image is also encrypted and I have the password (just doing this for study purposes).
what would be the best way to approach this requirement?
I tried mounting, decrypting and running the extractor on the virtual drive but it seems that's not quite the proper way. I would like to work on the image file itself but I was not able to find any info about how to do this. any help appreciated thanks a lot.