{"id":13511119,"url":"https://github.com/tribalchicken/volatility-filevault2","last_synced_at":"2025-03-30T20:32:36.553Z","repository":{"id":201255072,"uuid":"51649183","full_name":"tribalchicken/volatility-filevault2","owner":"tribalchicken","description":"Volatility plugin to extract FileVault 2 VMK's","archived":false,"fork":false,"pushed_at":"2021-09-20T21:01:42.000Z","size":6,"stargazers_count":49,"open_issues_count":0,"forks_count":8,"subscribers_count":5,"default_branch":"master","last_synced_at":"2024-11-01T13:33:53.057Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/tribalchicken.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null}},"created_at":"2016-02-13T14:29:17.000Z","updated_at":"2024-01-17T15:59:17.000Z","dependencies_parsed_at":null,"dependency_job_id":"f043e9bf-2bb0-4bf3-adbd-8c66413dcdfd","html_url":"https://github.com/tribalchicken/volatility-filevault2","commit_stats":null,"previous_names":["tribalchicken/volatility-filevault2"],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tribalchicken%2Fvolatility-filevault2","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tribalchicken%2Fvolatility-filevault2/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tribalchicken%2Fvolatility-filevault2/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tribalchicken%2Fvolatility-filevault2/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/tribalchicken","download_url":"https://codeload.github.com/tribalchicken/volatility-filevault2/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":246379366,"owners_count":20767694,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-08-01T03:00:34.827Z","updated_at":"2025-03-30T20:32:36.316Z","avatar_url":"https://github.com/tribalchicken.png","language":"Python","funding_links":[],"categories":["Volatility 2","\u003ca id=\"4d2a33083a894d6e6ef01b360929f30a\"\u003e\u003c/a\u003eVolatility"],"sub_categories":["Plugins"],"readme":"# volatility-filevault2\nThis is a volatility plugin which attempts to extract Apple FileVault 2 Volume Master Keys.\n\nWriteup is here: https://tribalchicken.net/extracting-filevault-2-keys-with-volatility/\n\nI have tested with OS X:\n- 10.9 \n- 10.10\n- 10.11\n- 10.12 (macOS)\n\nNOTE: Has not (yet) been tested on 32-bit OS X.\n\n## How it works\nFilevault appears to keep the volume master key in a consistently identifiable region of read only kernel memory. The method used by the plugin is very simple, as all the information is already exposed by Volatility.\n\nIn a nutshell, the plugin searches through the memory map of kernel space, searching for a string that is aligned on a map boundary and repeated exactly 0x430 bytes later.\n\nThats all there is to it (The writeup linked above has further information).\n\n## Usage\nfilevault2.py is a plugin for the Volatility Framework. You can either place the plugin in the plugins directory at `volatility/plugins`, or  alternatively, you can place the plugin in a separate directory and point volatility to it with `--plugins`\n\nFor example, using a directory called \"Plugins\":\n\n```\nvoldev$ ls plugins\nfielvault2.py\nvoldev$ volatility --plugins=plugins/ --profile=MacElCapitan_10_11_6_15G1004 -f osx10_11_6.vmem mac_filevault2\n```\n\n## Common Problems\n\n### Volatility tells you it needs something to do\n\nVolatility doesn't know about the plugin. Check the location of the plugin, and run `volatility --info` to determine if it is detected\n\n## \"No suitable address space mapping found\"\n\nThis isn't an issue with the plugin, but either the profile selected does not match the memory image or the image is in a format that is not understood. Ensure you have the correct profile selected (Keep in mind in some cases there can be different builds of the same OS X version)\n\n### The plugin doesn't find anything\nThere could be many causes.\n\n- The drive is not FileVault protected.\n- The memory image does not contain the key (Image captured after key is evicted from memory, overwritten during acquisition, etc)\n- The key exists but the plugin doesn't find it.\n\nIf you suspect the plugin isn't working for you then I would love to know.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Ftribalchicken%2Fvolatility-filevault2","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Ftribalchicken%2Fvolatility-filevault2","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Ftribalchicken%2Fvolatility-filevault2/lists"}