Skip to content
New issue

Have a question about this project? # for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “#”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? # to your account

Wrong Password / Unable to get volume! - I have the password #182

Open
sfrmattos opened this issue Jul 3, 2023 · 0 comments
Open

Wrong Password / Unable to get volume! - I have the password #182

sfrmattos opened this issue Jul 3, 2023 · 0 comments

Comments

@sfrmattos
Copy link

I'm trying to open a raw disk dump (dd). I have the password, the image is working if I attach it on OSX.
Although I have used this tool several times in the past, this time I am getting the message that the password is wrong / Unable to get volume.
The FS is APFS for sure, no T2 encryption, BUT I read about the issues on converted HFS to APFS on upgrades. It may be the case.
I can read other volumes on the partition (Preboot, Recovery, VM and System), but I cant read the DATA volume, which I need to advance on a forensic / criminal case.

Any help will be appreciated.

root@toc:/opt/apfs-fuse/build# ./apfsutil /dev/mapper/loop3p2 
Volume 0 F7946B5C-4D47-3777-9E2B-30144C00CC01
---------------------------------------------
Role:               Data
Name:               Mac HD - Data (Case-insensitive)
Capacity Consumed:  205424328704 Bytes
FileVault:          Yes
Snapshots:

Volume 1 4067C339-BE97-4BA7-BC2F-9D5EF6B98C1A
---------------------------------------------
Role:               Preboot
Name:               Preboot (Case-insensitive)
Capacity Consumed:  877477888 Bytes
FileVault:          No
Snapshots:

Volume 2 1C186B67-143F-4A8B-ADA3-76B27C42A4F7
---------------------------------------------
Role:               Recovery
Name:               Recovery (Case-insensitive)
Capacity Consumed:  1118236672 Bytes
FileVault:          No
Snapshots:

Volume 3 FE759382-636E-451C-8D8C-F0A42640FC0A
---------------------------------------------
Role:               VM
Name:               VM (Case-insensitive)
Capacity Consumed:  6445252608 Bytes
FileVault:          No
Snapshots:

Volume 4 32B8D8E1-BA18-4380-B578-8EB87AABFD96
---------------------------------------------
Role:               System
Name:               Mac HD (Case-insensitive)
Capacity Consumed:  21470388224 Bytes
FileVault:          No
Snapshots:
    26353920 : 'com.apple.os.update-DF8D8DEEAA66DC723E4167B090FDEA12FDB3C136FB7EBD12BF162940733437E4'
    26601593 : 'com.apple.os.update-MSUPrepareUpdate'

Volume 5 9B718628-D68C-48F8-9E5D-13663C6B2813
---------------------------------------------
Role:               Update
Name:               Update (Case-insensitive)
Capacity Consumed:  111411200 Bytes
FileVault:          No
Snapshots:
# for free to join this conversation on GitHub. Already have an account? # to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant