apfs-fuse icon indicating copy to clipboard operation
apfs-fuse copied to clipboard

Wrong Password / Unable to get volume! - I have the password

Open sfrmattos opened this issue 1 year ago • 0 comments

I'm trying to open a raw disk dump (dd). I have the password, the image is working if I attach it on OSX. Although I have used this tool several times in the past, this time I am getting the message that the password is wrong / Unable to get volume. The FS is APFS for sure, no T2 encryption, BUT I read about the issues on converted HFS to APFS on upgrades. It may be the case. I can read other volumes on the partition (Preboot, Recovery, VM and System), but I cant read the DATA volume, which I need to advance on a forensic / criminal case.

Any help will be appreciated.

root@toc:/opt/apfs-fuse/build# ./apfsutil /dev/mapper/loop3p2 
Volume 0 F7946B5C-4D47-3777-9E2B-30144C00CC01
---------------------------------------------
Role:               Data
Name:               Mac HD - Data (Case-insensitive)
Capacity Consumed:  205424328704 Bytes
FileVault:          Yes
Snapshots:

Volume 1 4067C339-BE97-4BA7-BC2F-9D5EF6B98C1A
---------------------------------------------
Role:               Preboot
Name:               Preboot (Case-insensitive)
Capacity Consumed:  877477888 Bytes
FileVault:          No
Snapshots:

Volume 2 1C186B67-143F-4A8B-ADA3-76B27C42A4F7
---------------------------------------------
Role:               Recovery
Name:               Recovery (Case-insensitive)
Capacity Consumed:  1118236672 Bytes
FileVault:          No
Snapshots:

Volume 3 FE759382-636E-451C-8D8C-F0A42640FC0A
---------------------------------------------
Role:               VM
Name:               VM (Case-insensitive)
Capacity Consumed:  6445252608 Bytes
FileVault:          No
Snapshots:

Volume 4 32B8D8E1-BA18-4380-B578-8EB87AABFD96
---------------------------------------------
Role:               System
Name:               Mac HD (Case-insensitive)
Capacity Consumed:  21470388224 Bytes
FileVault:          No
Snapshots:
    26353920 : 'com.apple.os.update-DF8D8DEEAA66DC723E4167B090FDEA12FDB3C136FB7EBD12BF162940733437E4'
    26601593 : 'com.apple.os.update-MSUPrepareUpdate'

Volume 5 9B718628-D68C-48F8-9E5D-13663C6B2813
---------------------------------------------
Role:               Update
Name:               Update (Case-insensitive)
Capacity Consumed:  111411200 Bytes
FileVault:          No
Snapshots:

sfrmattos avatar Jul 03 '23 21:07 sfrmattos