search

libyal / libfvde

Library and tools to access FileVault Drive Encryption (FVDE) encrypted volumes
GNU Lesser General Public License v3.0
341 stars 34 forks source link

libcsystem_string_decimal_copy_to_64_bit: unsupported character value: a at index: 0 #15

Closed ephemient closed 8 years ago

ephemient commented 8 years ago

This is the boot disk in a MBP, originally installed in 10.10, then resized to dual-boot Linux (where I'm running these commands from), and upgraded to 10.11.

$ fvdeinfo -e EncryptedRoot.plist.wipekey -p '' /dev/sda -v >fvdeinfo.txt 2>&1
$ fvdemount -e EncryptedRoot.plist.wipekey -p '' /dev/sda2 /mnt -v
fvdemount 20160719

libfvde_volume_set_utf8_password: user password: 
libfvde_encryption_context_plist_read_file_io_handle: reading file of size: 1867168

Unable to set volume offset.
libcsystem_string_decimal_copy_to_64_bit: unsupported character value: a at index: 0.
mount_handle_set_volume_offset: unable to copy string to 64-bit decimal.

fvdeinfo.txt

joachimmetz commented 8 years ago

The format of your image is not supported yet. Here the encrypted volume is likely split in 2 extents:

libfvde_encrypted_metadata_read_type_0x0405: entry: 00 block number : 0
libfvde_encrypted_metadata_read_type_0x0405: entry: 00 number of blocks : 65536
libfvde_encrypted_metadata_read_type_0x0405: entry: 00 data type    : 0x00000009
libfvde_encrypted_metadata_read_type_0x0405: entry: 00 copy number  : 0
libfvde_encrypted_metadata_read_type_0x0405: entry: 00 unknown1     : 0x00000000
libfvde_encrypted_metadata_read_type_0x0405: entry: 00 unknown2     : 0xfffffffffffffffe

libfvde_encrypted_metadata_read_type_0x0405: entry: 01 block number : 65536
libfvde_encrypted_metadata_read_type_0x0405: entry: 01 number of blocks : 24263264
libfvde_encrypted_metadata_read_type_0x0405: entry: 01 data type    : 0x00000009
libfvde_encrypted_metadata_read_type_0x0405: entry: 01 copy number  : 0
libfvde_encrypted_metadata_read_type_0x0405: entry: 01 unknown1     : 0x00000000
libfvde_encrypted_metadata_read_type_0x0405: entry: 01 unknown2     : 0x00000000

Changes are on their way to support this.

ephemient commented 8 years ago

Thanks, that makes sense.

joachimmetz commented 8 years ago

Experimental version 20160729 has basic support for these format changes.