Hi Laura,
Glad to hear you're getting somewhere.
Unfortunately I'm not aware of anything that can decrypt the swap/sleepimage files if encryption for those files was turned on.
On Windows, the pagefile.sys can also be encrypted but by default is not. The hiberfil.sys can't encrypted but is compressed. None of this is applicable to you however, since you are working with a Mac image.
You may want to contact the good people at Blackbag to see if they have any suggestions for the swap/sleepimage files.
Good luck,
Jad
↧