bulk_extractor on e...
 
Notifications
Clear all

bulk_extractor on encrypted image

1 Posts
1 Users
0 Reactions
649 Views
(@radical)
New Member
Joined: 10 months ago
Posts: 1
Topic starter  

Hi all

first post here and Im a real newb on forensics topics.

Playing a bit around with bulk_extractor Id like to use it with a clone image of an encrypted apfs drive. Image is also encrypted and I have the password (just doing this for study purposes).

what would be the best way to approach this requirement?

I tried mounting, decrypting and running the extractor on the virtual drive but it seems that's not quite the proper way. I would like to work on the image file itself but I was not able to find any info about how to do this. any help appreciated thanks a lot.


   
Quote
Share: