在本文中，我們將演示使用Data Extractor來識別使用FileVault加密的Macintosh系統(tǒng)中的加密密鑰位置。我們還將分享一些使用Data Extractor的技巧和方法。
In this article, we will demonstrate using Data Extractor to identify encryption key location in the Macintosh system encrypted with FileVault. We will also share some tips and techniques for using Data Extractor for maximum effectiveness.

我們注意到FileVault分區(qū)的加密密鑰。
We started by exploring the ‘(Mac OS X) Boot Recovery HD’ disk for a while we noticed there was the encryption key for FileVault partition.

當(dāng)我們輸入FileVault分區(qū)的密碼時，該密鑰將被應(yīng)用。名為’EncryptedRoot.plist.wipekey’，保存于’com.apple.corestorage’文件夾中。
This key is applied when we enter the password for FileVault partition. It’s called ‘EncryptedRoot.plist.wipekey’ and located in ‘com.apple.corestorage’ folder.

我們將這個文件保存到本地磁盤上
We were getting this file and saving in the special place on the local disk.

在某些情況下，該文件可以位于另一個地方或被刪除。
For some cases, this file can be located in another place or be removed.

我們的目的是在我們輸入加密分區(qū)的密碼時上傳這個文件，所以盡管我們不寫這個文件，但是我們知道文件的確切名稱，可以在另一個地方找到它。
Our goal is to upload this file when we enter the password for encrypted partition, so although?we don’t where this file is written to, we know the exact name of the file and can find it in another place.

當(dāng)文件被刪除或分區(qū)格式化時，我們分別使用“掃描目錄文件”選項或“分區(qū)分析”。
When the file was deleted or the partition was formatted we use ‘Scan Catalog file’ option or ‘Partition analysis’, respectively.

我們創(chuàng)建加密分區(qū)的映射。
We created a map of encrypted partition.

當(dāng)您為加密的分區(qū)創(chuàng)建位圖時，有一個重要的參數(shù):Data Extractor要求您創(chuàng)建驅(qū)動器的子位圖。它看起來像這樣:
This is an important parameter when you create a map for encrypted?partition: Data Extractor asks you to create submap of the drive. It looks like this:

關(guān)鍵在于，F(xiàn)ileVault解密程序?qū)ι葏^(qū)位置非常敏感。當(dāng)我們創(chuàng)建驅(qū)動器的子映射時，扇區(qū)將被轉(zhuǎn)移，而Data Extractor無法找到支持扇區(qū)并對分區(qū)進(jìn)行解密。所以，我們的選擇是“不”。
The point is that FileVault decryption procedure is sensitive to sectors location. When we create submap of the drive, sectors are shifted and Data Extractor can’t find support sectors and decrypt the partition. So, our selection is ‘NO’.

應(yīng)用位圖作為加密磁盤并輸入密碼。
Applied map as encrypted disk and enter the password.

重新生成以下報告：
That regenerated the following report:

最后，我們得到的文件結(jié)構(gòu)：
Finally, we were getting the file structure:

可以打開文件
And could open files:

Please keep your eyes on these?features when you can’t decrypt FileVault partition using Data Extractor. It might not be a common issue but we hope it helped you in some cases.

數(shù)據(jù)恢復(fù)快樂
Happy data recovering!

轉(zhuǎn)載請注明：成都千喜數(shù)據(jù)恢復(fù)中心 » 使用PC-3000 Data Extractor解密Apple FileVault實例