You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
I'm trying to open a raw disk dump (dd). I have the password, the image is working if I attach it on OSX.
Although I have used this tool several times in the past, this time I am getting the message that the password is wrong / Unable to get volume.
The FS is APFS for sure, no T2 encryption, BUT I read about the issues on converted HFS to APFS on upgrades. It may be the case.
I can read other volumes on the partition (Preboot, Recovery, VM and System), but I cant read the DATA volume, which I need to advance on a forensic / criminal case.
Any help will be appreciated.
root@toc:/opt/apfs-fuse/build# ./apfsutil /dev/mapper/loop3p2
Volume 0 F7946B5C-4D47-3777-9E2B-30144C00CC01
---------------------------------------------
Role: Data
Name: Mac HD - Data (Case-insensitive)
Capacity Consumed: 205424328704 Bytes
FileVault: Yes
Snapshots:
Volume 1 4067C339-BE97-4BA7-BC2F-9D5EF6B98C1A
---------------------------------------------
Role: Preboot
Name: Preboot (Case-insensitive)
Capacity Consumed: 877477888 Bytes
FileVault: No
Snapshots:
Volume 2 1C186B67-143F-4A8B-ADA3-76B27C42A4F7
---------------------------------------------
Role: Recovery
Name: Recovery (Case-insensitive)
Capacity Consumed: 1118236672 Bytes
FileVault: No
Snapshots:
Volume 3 FE759382-636E-451C-8D8C-F0A42640FC0A
---------------------------------------------
Role: VM
Name: VM (Case-insensitive)
Capacity Consumed: 6445252608 Bytes
FileVault: No
Snapshots:
Volume 4 32B8D8E1-BA18-4380-B578-8EB87AABFD96
---------------------------------------------
Role: System
Name: Mac HD (Case-insensitive)
Capacity Consumed: 21470388224 Bytes
FileVault: No
Snapshots:
26353920 : 'com.apple.os.update-DF8D8DEEAA66DC723E4167B090FDEA12FDB3C136FB7EBD12BF162940733437E4'
26601593 : 'com.apple.os.update-MSUPrepareUpdate'
Volume 5 9B718628-D68C-48F8-9E5D-13663C6B2813
---------------------------------------------
Role: Update
Name: Update (Case-insensitive)
Capacity Consumed: 111411200 Bytes
FileVault: No
Snapshots:
The text was updated successfully, but these errors were encountered:
I'm trying to open a raw disk dump (dd). I have the password, the image is working if I attach it on OSX.
Although I have used this tool several times in the past, this time I am getting the message that the password is wrong / Unable to get volume.
The FS is APFS for sure, no T2 encryption, BUT I read about the issues on converted HFS to APFS on upgrades. It may be the case.
I can read other volumes on the partition (Preboot, Recovery, VM and System), but I cant read the DATA volume, which I need to advance on a forensic / criminal case.
Any help will be appreciated.
The text was updated successfully, but these errors were encountered: