How to extract the hashes for decryption of Macbook disk?

General (Technical, Procedural, Software, Hardware etc.)

Last Post by doublezero 6 years ago

1 Posts

1 Users

0 Reactions

1,570 Views

RSS

doublezero

(@doublezero)

Active Member

Joined: 6 years ago

Posts: 12

Topic starter 17/04/2019 4:47 pm

Hey guys.

I'm working in a case where we have a Macbook encrypted (AES-XTS), and we dont have the recovery key or password, but I was able to recover the EncryptedRoot.plist.wipekey. I found some info on how to recover the hashes for using with hashcat (https://hashcat.net/forum/thread-7620.html?highlight=filevault) but I was unable to reproduce the results in our lab.

Anyone with experience working with encrypted mac devices?

Thank you!

Quote

8 Forums
15.7 K Topics
92.3 K Posts
252 Online
41.1 K Members

Forum Icons: Forum contains no unread posts Forum contains unread posts

Topic Icons: Not Replied Replied Active Hot Sticky Unapproved Solved Private Closed