Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Wrong Password / Unable to get volume! - I have the password #182

Open
sfrmattos opened this issue Jul 3, 2023 · 0 comments
Open

Wrong Password / Unable to get volume! - I have the password #182

sfrmattos opened this issue Jul 3, 2023 · 0 comments

Comments

@sfrmattos
Copy link

I'm trying to open a raw disk dump (dd). I have the password, the image is working if I attach it on OSX.
Although I have used this tool several times in the past, this time I am getting the message that the password is wrong / Unable to get volume.
The FS is APFS for sure, no T2 encryption, BUT I read about the issues on converted HFS to APFS on upgrades. It may be the case.
I can read other volumes on the partition (Preboot, Recovery, VM and System), but I cant read the DATA volume, which I need to advance on a forensic / criminal case.

Any help will be appreciated.

root@toc:/opt/apfs-fuse/build# ./apfsutil /dev/mapper/loop3p2 
Volume 0 F7946B5C-4D47-3777-9E2B-30144C00CC01
---------------------------------------------
Role:               Data
Name:               Mac HD - Data (Case-insensitive)
Capacity Consumed:  205424328704 Bytes
FileVault:          Yes
Snapshots:

Volume 1 4067C339-BE97-4BA7-BC2F-9D5EF6B98C1A
---------------------------------------------
Role:               Preboot
Name:               Preboot (Case-insensitive)
Capacity Consumed:  877477888 Bytes
FileVault:          No
Snapshots:

Volume 2 1C186B67-143F-4A8B-ADA3-76B27C42A4F7
---------------------------------------------
Role:               Recovery
Name:               Recovery (Case-insensitive)
Capacity Consumed:  1118236672 Bytes
FileVault:          No
Snapshots:

Volume 3 FE759382-636E-451C-8D8C-F0A42640FC0A
---------------------------------------------
Role:               VM
Name:               VM (Case-insensitive)
Capacity Consumed:  6445252608 Bytes
FileVault:          No
Snapshots:

Volume 4 32B8D8E1-BA18-4380-B578-8EB87AABFD96
---------------------------------------------
Role:               System
Name:               Mac HD (Case-insensitive)
Capacity Consumed:  21470388224 Bytes
FileVault:          No
Snapshots:
    26353920 : 'com.apple.os.update-DF8D8DEEAA66DC723E4167B090FDEA12FDB3C136FB7EBD12BF162940733437E4'
    26601593 : 'com.apple.os.update-MSUPrepareUpdate'

Volume 5 9B718628-D68C-48F8-9E5D-13663C6B2813
---------------------------------------------
Role:               Update
Name:               Update (Case-insensitive)
Capacity Consumed:  111411200 Bytes
FileVault:          No
Snapshots:
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant