Macbook Air A2179 hardware encrypted.

If a Mac has a T2, M1, or M2 chip, its APFS container will be protected by hardware-encoded encryption key that's not accessible outside of the Mac.

This is a block-level encryption, not an end-to-end disk or volume encryption. As far as I'm aware, it cannot be disabled and requires the APFS container to be read in situ.

• https://www.google.com/search?q=mac+t2+security+site%3Aapple.com
• https://www.google.com/search?q=t2+m1+m2+forensics+mac

@sdckey we've just published an article on Apple T2 encryption today 🙂

https://blog.passware.com/from-filevault-to-t2-how-to-deal-with-native-apple-encryption/

Digital Collector from Cellebrite can take an image of the data partition on a macbook if you have the credentials.