bulk_extractor on e...
Clear all

bulk_extractor on encrypted image

1 Posts
1 Users
0 Reactions
Posts: 1
New Member
Topic starter

Hi all

first post here and Im a real newb on forensics topics.

Playing a bit around with bulk_extractor Id like to use it with a clone image of an encrypted apfs drive. Image is also encrypted and I have the password (just doing this for study purposes).

what would be the best way to approach this requirement?

I tried mounting, decrypting and running the extractor on the virtual drive but it seems that's not quite the proper way. I would like to work on the image file itself but I was not able to find any info about how to do this. any help appreciated thanks a lot.

Posted : 28/04/2024 12:06 pm