• Lemonde
  • Advanced Member Topic Starter
5 years ago
We have been looking at an OSX disk that may have been encrypted at time of imaging and are finding the following:

The EFI partition is in one piece and can be viewed

The system partition is completely blank and has only 'unallocated clusters' showing

The recovery partition appears intact

Does this mean that the system was encrypted with a boot-up password and as a result the whole partition was unreadable at time of imaging and so we are unable to recover even with the encryption codes?

I presume if it was one of the OSX FileVault encryptions we would not be able to see any of the disk as the whole disk is encrypted but would it register in Encase as unallocated clusters or something different?


Want to thank us? Use: Patreon or PayPal or Bitcoins: 12G4A52Znm5s35buKDEmKU2p2vQY69Nsyo

All opinions expressed within these pages are sent in by members of the public or by our staff in their spare time, and as such do not represent any opinion held by sircles.net Ltd or their partners.