Infographic for tutorial on using Belkasoft Digital Forensic Tools. Infographic for tutorial on using Belkasoft Digital Forensic Tools.

Mounting and Reimaging an Encrypted FileVault2 Mac Image in Linux

Mari DeGrazia continues her Mac imaging series. This time she covers how to mount and work with FileVault2 encrypted Mac images.

According to Mari, you’ll need three things:

1) A full disk image of the encrypted system in raw format
2) The SIFT Workstation
3) The password or recovery key for the volume

tux_filevault_forensics

Here is the link to full article.