FileVault encrypted...
 
Notifications
Clear all

FileVault encrypted MacBook on but locked

4 Posts
2 Users
0 Reactions
501 Views
(@wotsits)
Reputable Member
Joined: 10 years ago
Posts: 253
Topic starter  

It appears the MacBook is on and decrypted past the initial screen that asks for the FileVault password when you turn it on for the first time after a shut down. But it has been allowed to lock from inactivity and requires the password.

If my understanding is correct then it is still decrypted and there should be some way to extract the encryption key - I would know how to do this in a Windows computer but not a Mac. I don't want to turn it off and image the hard drive yet as this might be the only chance to obtain the encryption key.

Can anyone shine any light on what to do in this situation? Or is it not possible to obtain the key unless fully logged on in a Mac?


   
Quote
jaclaz
(@jaclaz)
Illustrious Member
Joined: 18 years ago
Posts: 5133

   
ReplyQuote
(@wotsits)
Reputable Member
Joined: 10 years ago
Posts: 253
Topic starter  

http//www.forensicfocus.com/Forums/viewtopic/p=6586535/#6586535

jaclaz

Thank you for bringing this to my attention.

The post refers to patches in the December 2016 update. Keeping in mind that this is a recently acquired device and could have all the latest updates, does that mean that the method described is no longer possible on machines updated post this December?

If so, do any other methods exist? I'd be quite embarrassed to request $300 for a piece of equipment that no longer does the job.


   
ReplyQuote
jaclaz
(@jaclaz)
Illustrious Member
Joined: 18 years ago
Posts: 5133
 

The post refers to patches in the December 2016 update. Keeping in mind that this is a recently acquired device and could have all the latest updates, does that mean that the method described is no longer possible on machines updated post this December?

Yes. very likely it won't work anymore

December 13th Apple released macOS 10.12.2 which contains the security update. At least for some hardware - like my MacBook Air.

If so, do any other methods exist? I'd be quite embarrassed to request $300 for a piece of equipment that no longer does the job.

Not that I know of.

jaclaz


   
ReplyQuote
Share: