Greetings,
I had a job come in the other day which was a Macbook air with FileVault2 "Disk" (well, volume) encryption enabled.
I see in the release notes for EnCase 7.08 that FileVault2 partitions can be decrypted, assuming you know the password of course.
I could not see how to do this in EnCase 7.08 so instead had to muck about with a blownback disk on a spare Apple machine and image the unlocked partition that way.
My question is, has anyone managed to image/open a filevault2 partition with EnCase 7? My disk structure was as follows:
EFI
Macintosh HD (Filevault2 partition, all unallocated)
Recovery HD
This would save a bit of time in future, that's all.
Cheers.
↧