Apple Fusion Drive - libfvde_encrypted_metadata_read_type_0x001a: unable to retrieve logical volume descriptor with object identifier: 1141

libyal / libfvde

Library and tools to access FileVault Drive Encryption (FVDE) encrypted volumes

GNU Lesser General Public License v3.0

339 stars 34 forks source link

Apple Fusion Drive - libfvde_encrypted_metadata_read_type_0x001a: unable to retrieve logical volume descriptor with object identifier: 1141 #56

Open arcticforensics opened 2 years ago

arcticforensics commented 2 years ago

I'm attempting to use libfvde 20220420 (Windows) to decrypt an Apple Fusion drive with FileVault2 encryption - fvdemount returns; "libfvde_encrypted_metadata_read_type_0x001a: unable to retrieve logical volume descriptor with object identifier: 1141". See debug text file attached.

Command-line; fvdemount -v -e d:\EncryptedRoot.plist.wipekey -p "#######" -o 209735680 \\.\physicaldrive3 \\.\physicaldrive4 mount_point

debug.txt.gz