logo
Welcome Guest! To enable all features please Login or Register.

Notification

Icon
Error

Options
Go to last post Go to first unread
Lemonde  
#1 Posted : 15 June 2017 08:58:37(UTC)
Lemonde

Rank: Advanced Member

Groups: Registered
Joined: 08/01/2017(UTC)
Posts: 137
United Kingdom
Location: London

We have been looking at an OSX disk that may have been encrypted at time of imaging and are finding the following:

The EFI partition is in one piece and can be viewed

The system partition is completely blank and has only 'unallocated clusters' showing

The recovery partition appears intact

Does this mean that the system was encrypted with a boot-up password and as a result the whole partition was unreadable at time of imaging and so we are unable to recover even with the encryption codes?

I presume if it was one of the OSX FileVault encryptions we would not be able to see any of the disk as the whole disk is encrypted but would it register in Encase as unallocated clusters or something different?
Sponsor
Users browsing this topic
Forum Jump  
You cannot post new topics in this forum.
You cannot reply to topics in this forum.
You cannot delete your posts in this forum.
You cannot edit your posts in this forum.
You cannot create polls in this forum.
You cannot vote in polls in this forum.