Join Us!

How to extract the ...
 
Notifications
Clear all

How to extract the hashes for decryption of Macbook disk?  

  RSS
doublezero
(@doublezero)
New Member

Hey guys.

I'm working in a case where we have a Macbook encrypted (AES-XTS), and we dont have the recovery key or password, but I was able to recover the EncryptedRoot.plist.wipekey. I found some info on how to recover the hashes for using with hashcat (https://hashcat.net/forum/thread-7620.html?highlight=filevault) but I was unable to reproduce the results in our lab.

Anyone with experience working with encrypted mac devices?

Thank you!

Quote
Posted : 17/04/2019 4:47 pm
Share: