4

I have a osx 10.9 machine with a File Vault1 encrypted user partition. I would like to remove the encryption, but I don't remember the "master key" which is the only way to remove encryption on-the-fly without reinstalling everything.

Moreover I have

  • physical access
  • user and root password which are same (but not masterkey which is different)
  • memory dump while machine was running and file system mounted and readable (ELF RAW and MACH format, each about 5gigabyte)

What I tried to get the password:

  • With disk decryptor to search for the keys automatically. The result looks like a list:

    Algorithm: 'PGP' Volume Master Key (AES-256) Key data (hex): 6f757268617264776f726b62797468657365776f72647367756172646564706c
    When I converted it I got:
    ourhardworkbythesewordsguardedpl
    Which is not the password, but a string of fakesmc.kext. There are other hex values as well, but not human readable if I convert them from hex to text using hex2text

  • Tried this which is intended for filefault2 human readable string search

    strings memdump_0x100000-0x100000000.bin | grep --after-context=5 AuthorityRequestType | grep --after-context=1 password | sed "s/^`//g"

    But it gives me back nothing. If i remove or modify some grep arguments it gives me back a hole bunch of strings but I don't even know what and where to look at or how the structure is.

  • Look around in backtrack/kali but I could not figure out how I should approach the final step.

How can I extract the master key? Should be even easier because its only version 1, but nothing - it seems even more complex, so any help is really appreciated =)

Improve this question

1 Answer 1

Reset to default
1

It's been nine days with no other answers, so I'll put in this poor attempt. As a note, your references to both "master key" and "master password" are a bit confusing.

Start by looking at the john-dev mailing list entry on FileVault cracking; in particular, that post lists VileFault which may be of some use to you, and Openciphers appears to have an FPGA FileVault implementation if you have a budget.

Also, Jeremiah Grossman had perhaps a similar problem.

Peachpit has an article that has guidance on resetting the master password assuming you know the FileVault passwords, if that helps you.

The actual encryption key should certainly be in RAM when you're able to decrypt the files - can you see what areas of RAM are being accessed every time you read files?

Last, I assume simply copying them all off to an external drive and then back to a fresh partition isn't suitable, since you mentioned "installing" everything again?

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .