I have a osx 10.9 machine with a File Vault1 encrypted user partition. I would like to remove the encryption, but I don't remember the "master key" which is the only way to remove encryption on-the-fly without reinstalling everything.
Moreover I have
- physical access
- user and root password which are same (but not masterkey which is different)
- memory dump while machine was running and file system mounted and readable (ELF RAW and MACH format, each about 5gigabyte)
What I tried to get the password:
With disk decryptor to search for the keys automatically. The result looks like a list:
Algorithm: 'PGP' Volume Master Key (AES-256) Key data (hex): 6f757268617264776f726b62797468657365776f72647367756172646564706c
When I converted it I got:
Which is not the password, but a string of fakesmc.kext. There are other hex values as well, but not human readable if I convert them from hex to text using hex2text
Tried this which is intended for filefault2 human readable string search
strings memdump_0x100000-0x100000000.bin | grep --after-context=5 AuthorityRequestType | grep --after-context=1 password | sed "s/^`//g"
But it gives me back nothing. If i remove or modify some grep arguments it gives me back a hole bunch of strings but I don't even know what and where to look at or how the structure is.
Look around in backtrack/kali but I could not figure out how I should approach the final step.
How can I extract the master key? Should be even easier because its only version 1, but nothing - it seems even more complex, so any help is really appreciated =)