You are right, thanks for correcting me! I have read the original post, just I have no idea why, I misunderstood the thing, like not having the password. I think now all is clear…
Everybody else making this kind of mistakes don't reply to posts when you are tired!!! )
No problem passcodeunlock, and also just to add to your comment, the .wipekey exists on the HDD and is available to be carved out/extracted manually, no memory dump is required. It can be found in the Recovery partition, which is an unencrypted area of the disk.
/System/Library/Caches/com.apple.corestorage/
No problem passcodeunlock, and also just to add to your comment, the .wipekey exists on the HDD and is available to be carved out/extracted manually, no memory dump is required. It can be found in the Recovery partition, which is an unencrypted area of the disk.
Disk, which specifically in this case is NOT ACCESSIBLE!
We can continue like this, it is fun D , but I'd better ask "the officer in the case" (which also doesn't exist as this is not a forensics case, but rather a data recovery one after a Mac has been accidentally flooded with coffee).
jaclaz
No problem passcodeunlock, and also just to add to your comment, the .wipekey exists on the HDD and is available to be carved out/extracted manually, no memory dump is required. It can be found in the Recovery partition, which is an unencrypted area of the disk.
Disk, which specifically in this case is NOT ACCESSIBLE!
We can continue like this, it is fun D , but I'd better ask "the officer in the case" (which also doesn't exist as this is not a forensics case, but rather a data recovery one after a Mac has been accidentally flooded with coffee).
jaclaz
Apologies, I wasn't aware it was completely inaccessible, just showing as "non initialized disk" in Windows.
Also, the OP did not specify that it wasn't a forensic case. It could be a forensic case involving a laptop that has been covered in coffee.