Date: Thu, 30 Aug 2018 17:27:49 +0530 From: Dhiru Kholia <dhiru.kholia@...il.com> To: john-users@...ts.openwall.com Subject: Re: Filevault2 volume without password On Wed, Aug 29, 2018 at 10:03 PM, CRO <enigmista1980@...il.com> wrote: > $ sudo fvdetools/fvdeinfo -e EncryptedRoot.plist.wipekey -p dummy > > $fvde$1$16$73d49f736090a65.........45c3e49ae34c12 > > Is $fvde$1$16$73d49f736090a65.........45c3e49ae34c12 the hash? > > If yes, BINGO! Thank you! Seems like it. As usual, create and crack a test hash using a known password to validate your tools, steps, etc. > Are "normal" errors after the hash? > Why used EncryptedRoot.plist.wipekey? It seems that EncryptedRoot.plist.wipekey stuff is required for encrypted "system disk" but not for external encrypted disks. Overall, if there is a EncryptedRoot.plist.wipekey file on the Recovery partition, then I guess you need to use it. https://github.com/libyal/libfvde/issues/35 (EncryptedRoot... missing on encrypted external device) is relevant here. Also see http://az4n6.blogspot.com/2016/07/mounting-and-reimaging-encrypted.html. Dhiru
Powered by blists - more mailing lists
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.