-m 16700 Filevault

[uennotec]

mmls and others are part of the Sleuthkit; it can easily be installed on a mac via brew

if you have the drive physically attached, why not simply search with diskutil list for the RecoveryHD and mount it? finally, you can drag-and-drop the file with finder

Hi,

I mounted the RecoveryHD and extracted the "EncryptedRoot.plist.wipekey". I then did:

sudo fvdetools/fvdeinfo -e EncryptedRoot.plist.wipekey -p whatever /dev/disk3s2

(mine is not called Encrypted.plist.wipekey, as in your command)

It then gives me 2 different Hashes. (which are displayed 2 times each, so 4 lines with 2 different hashes)

How do I know which is the correct one? Could it be, that this error is connected to the fact, that the userpassword on this machine was changed, and after that either the old, nor ne new password worked any more?

greetz uennotec