search

libyal / libfvde

Library and tools to access FileVault Drive Encryption (FVDE) encrypted volumes
GNU Lesser General Public License v3.0
339 stars 34 forks source link

libfvde_metadata_block_read_data: unsupported block size: 7312611905704139 #53

Closed arcticforensics closed 2 years ago

arcticforensics commented 2 years ago

debug.txt

Same problem as issue #40???

Unable to open source volume libfvde_metadata_block_read_data: unsupported block size: 7312611905704139.

libfvde_encrypted_metadata_read: unable to read metadata block.

libfvde_volume_open_read: unable to read primary encrypted metadata.

libfvde_volume_open_file_io_handle: unable to read from file IO handle.

mount_handle_open: unable to open volume.

fvdemount version 20210907

arcticforensics commented 2 years ago

This may be an issue with earlier versions of Mac OS X. The error above occurred when attempting to read a thumb drive formatted as a single CoreStorage device (diskutil corestorage create ....) created using Mac OS Yosemite (10.10). However, formatting an identical thumb drive using the same command with Mac OS Catalina (10.15), fvdemount works!

joachimmetz commented 2 years ago

Yes this issue is similar to https://github.com/libyal/libfvde/issues/40, though that it happens after an encrypted metadata block 0x0011 instead of 0x001a.

joachimmetz commented 2 years ago

Closing this in favor of https://github.com/libyal/libfvde/issues/40, @arcticforensics if the image can be shared or the test case can be added to https://github.com/dfirlabs/core-storage-specimens that could be useful in determining if this is an unsupported format feature or something else.