search

sgan81 / apfs-fuse

FUSE driver for APFS (Apple File System)
GNU General Public License v2.0
1.78k stars 164 forks source link

Encryption dependencies for apfs-fuse #64

Closed graysky2 closed 6 years ago

graysky2 commented 6 years ago

I created a bit-for-bit copy of my system partion on my Macbook using dd and would like to attempt to recover deleted files from the corresponding image using apfs-fuse on my Linux box + photorec. The partition I imaged on the Mac is APFS and is encrypted. I have "Recovery Key Escrow URL UUID" generated at the time the encryption was setup, but entering it as the password does not allow apfs-fuse to unlock:

% apfs-fuse -o loop  /mnt/data/data/sda2.img /mnt/mini
Volume Macintosh HD is encrypted.
Enter Password: 
Wrong password!
Unable to get volume!

Perhaps I am incorrect in thinking that string is the password. Any advice is appreciated. Thanks!

EDIT: I can post the output of apfs-dump-quick /mnt/data/data/sda2.img dumpout.log if it would be helpful. It too challenges me to the password but ends with:

...
Password doesn't work for any key.
Wrong password!
Volume 1: Preboot
Volume 2: Recovery
Volume 3: VM
graysky2 commented 6 years ago

Sorry for the noise... I see now the password for the encryption is the literal user password /head smack/

linusheck commented 2 years ago

Hi, did you ever manage to recover files using this method? I am trying to do the same thing right now. Thank you!