sgan81 / apfs-fuse

FUSE driver for APFS (Apple File System)
GNU General Public License v2.0
1.74k stars 164 forks source link

Failed to Decryption of secondary drive (tier2) data in iMac APFS Fusion Encrypted Drive #150

Closed Santosh123-creater closed 3 years ago

Santosh123-creater commented 3 years ago

Hi

I have tested decryption code of normal APFS encrypted drive and File Vault drive. Its working fine for both of the cases. But it failed in case of encrypted data exits in secondary drive in iMac Fusion Drive. We successfully retrieve VEK from primary disk and decrypted primary disk's data but same VEK in not properly decrypted data from secondary drive.

Is there any changes of Decryption of secondary drive data in iMac Fusion Drive ? Is there any changes in tweak key(sector no) for encrypted data in secondary drive ?

I have debug the application in normal iMac drive and sector no is OK. Primary drive's found VEK properly decrypted in primary disk and showed the file folder's hierarchy proper.

But due to fusion drive, the data exists in secondary drive in encrypted mode.

The same VEK is unable to decrypt it in encrypted iMac of same offset but in case of Non-Encrypted iMac, I am able to view correct data with same offset.

What will the possible reason? Is there any changes of code of apfs-fuse. Please help me and provide any changes in code. Please reply.

Thanks Santosh

Santosh123-creater commented 3 years ago

I am not sure about primary disk decryption but all data position switched in secondary drive and decryption is not working in case of Fusion drive iMac however same code is working in case of APFS Encrypted drive and APFS File Vault.

Santosh123-creater commented 3 years ago

Dear Sir, Please reply.

Santosh123-creater commented 3 years ago

Dear Sir, problem still not resolved, please reply for if any changes in source code.