Filevault 2 Encrypted HDD image

Try this

http//digital-forensics.sans.org/community/downloads (SIFT)

It has this library

https://github.com/libyal/libfvde/blob/master/documentation/FileVault%20Drive%20Encryption%20(FVDE).asciidoc

Good luck.

I've played around with SIFT before and I find it a particularly frustrating piece of software. evil

I reckon it's possible through DFVFS, but I don't know how.
If it is then there's a possibility that you could use Pancake Viewer in the future

I've played around with SIFT before and I find it a particularly frustrating piece of software. evil

If you want to share what you did that didn't work, or what you have questions on, I'm pretty confident we could point out references and other steps.

The frustration with SIFT comes primarily from my own lack of experience with using CLI based forensic software and a lack of time/willingness to learn.

I know the team that put SIFT together know their stuff and I have full confidence that the software does what it says on the box, it's purely a "me" problem with this.

I may sit down again at some point if I get a week off to look closer at the software, but one thing that jumped out at me straight away is the lack of clear 'how to' guides on using the software. Plenty of information out there but they all seem written with the pre-supposition that the reader/user is has an advanced understanding of using Unix based OS's so lots of helpful information is missing.

To be honest I don't have a massive motivation to learn the software as I have a pretty decent software library of commercial tools, but every now and then something comes along where SIFT of one of the open source tools would be good to know.

I use Paladin and DEFT semi regularly so I'm not averse to these types of tools, just find them difficult to get my head thinking in that direction I guess.

Yeah…if your adverse to using a cli that might hold you back from FOSS options. I am curious if you will get any more replies…the message I have gotten, as a rule of thumb from other practitioners, is that you need a mac to do mac forensics. If you took the time to mess with the cli side of things (check out linuxleo) it might pay you back if getting a mac is not a option for your shop.

Blacklight would work for this case. (https://www.blackbagtech.com/blacklight.html) It's very handy and has both Windows and Mac version installs.

Blacklight would work for this case. (https://www.blackbagtech.com/blacklight.html) It's very handy and has both Windows and Mac version installs.

It cannot decrypt AFV2 protected drives. (As of 2016R1…maybe R2) You have to run it on a Mac.

I haven't tried this but it may work through a write blocker
http//www.catacombae.org/hfsexplorer/

I just loaded up an encrypted DMG and it was quite easy to use
the menu options indicate that you can use it for a drive as well