I'm trying to open a raw disk dump (dd). I have the password, the image is working if I attach it on OSX.
Although I have used this tool several times in the past, this time I am getting the message that the password is wrong / Unable to get volume.
The FS is APFS for sure, no T2 encryption, BUT I read about the issues on converted HFS to APFS on upgrades. It may be the case.
I can read other volumes on the partition (Preboot, Recovery, VM and System), but I cant read the DATA volume, which I need to advance on a forensic / criminal case.
Any help will be appreciated.
root@toc:/opt/apfs-fuse/build# ./apfsutil /dev/mapper/loop3p2
Volume 0 F7946B5C-4D47-3777-9E2B-30144C00CC01
---------------------------------------------
Role: Data
Name: Mac HD - Data (Case-insensitive)
Capacity Consumed: 205424328704 Bytes
FileVault: Yes
Snapshots:
Volume 1 4067C339-BE97-4BA7-BC2F-9D5EF6B98C1A
---------------------------------------------
Role: Preboot
Name: Preboot (Case-insensitive)
Capacity Consumed: 877477888 Bytes
FileVault: No
Snapshots:
Volume 2 1C186B67-143F-4A8B-ADA3-76B27C42A4F7
---------------------------------------------
Role: Recovery
Name: Recovery (Case-insensitive)
Capacity Consumed: 1118236672 Bytes
FileVault: No
Snapshots:
Volume 3 FE759382-636E-451C-8D8C-F0A42640FC0A
---------------------------------------------
Role: VM
Name: VM (Case-insensitive)
Capacity Consumed: 6445252608 Bytes
FileVault: No
Snapshots:
Volume 4 32B8D8E1-BA18-4380-B578-8EB87AABFD96
---------------------------------------------
Role: System
Name: Mac HD (Case-insensitive)
Capacity Consumed: 21470388224 Bytes
FileVault: No
Snapshots:
26353920 : 'com.apple.os.update-DF8D8DEEAA66DC723E4167B090FDEA12FDB3C136FB7EBD12BF162940733437E4'
26601593 : 'com.apple.os.update-MSUPrepareUpdate'
Volume 5 9B718628-D68C-48F8-9E5D-13663C6B2813
---------------------------------------------
Role: Update
Name: Update (Case-insensitive)
Capacity Consumed: 111411200 Bytes
FileVault: No
Snapshots:
I'm trying to open a raw disk dump (dd). I have the password, the image is working if I attach it on OSX. Although I have used this tool several times in the past, this time I am getting the message that the password is wrong / Unable to get volume. The FS is APFS for sure, no T2 encryption, BUT I read about the issues on converted HFS to APFS on upgrades. It may be the case. I can read other volumes on the partition (Preboot, Recovery, VM and System), but I cant read the DATA volume, which I need to advance on a forensic / criminal case.
Any help will be appreciated.