12-21-2018, 02:54 PM
Little update:
-m 16700 works also for Filevault on latest APFS filesystem, but only on macOS High Sierra (10.13)
Simply follow the guide of this fork in order to recover the hash.
Cut the padding zeroes (16 bytes) and you are good to go.
This technique is not possible any more since macOS Mojave (10.14); I suppose that Apple did some small changes and that apfs-fuse (or the fork?) needs to be recalibrated.
-m 16700 works also for Filevault on latest APFS filesystem, but only on macOS High Sierra (10.13)
Simply follow the guide of this fork in order to recover the hash.
Cut the padding zeroes (16 bytes) and you are good to go.
This technique is not possible any more since macOS Mojave (10.14); I suppose that Apple did some small changes and that apfs-fuse (or the fork?) needs to be recalibrated.