macmade / filevaultcracker

macOS FileVault cracking tool

FileVaultCracker

About

macOS FileVault cracking tool.

Disclaimer

I wrote this software in order to help relatives of a deceased friend to recover data from his computer.
Please enjoy it responsibly, and please do not hack/harm people.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

License

FileVaultCracker is released under the terms of the MIT license.

Repository Infos

Owner:          Jean-David Gadina - XS-Labs
Web:            www.xs-labs.com
Blog:           www.noxeos.com
Twitter:        @macmade
GitHub:         github.com/macmade
LinkedIn:       ch.linkedin.com/in/macmade/
StackOverflow:  stackoverflow.com/users/182676/macmade

filevaultcracker's Issues

High Sierra 10.13 Beta 3 FileVault locked hard drive and only 60% complete

Please help... I have a 2014 MacBook Pro with 1TB SSD. I installed High Sierra 10.13 beta 3 and FileVault ran then froze 60% completed. I can't log into my Hard drive now and the password causes a kernel panic, then reboot loop each time. I beg you, please help.

Marks-iMac:/ root# diskutil apfs list
APFS Container (1 found)
|
+-- Container disk1 485B7C24-832B-40BE-B6BB-C869492DB627
====================================================
APFS Container Reference: disk1
Capacity Ceiling (Size): 999040462848 B (999.0 GB)
Capacity In Use By Volumes: 967064211456 B (967.1 GB) (96.8% used)
Capacity Available: 31976251392 B (32.0 GB) (3.2% free)
|
+-< Physical Store disk0s2 51500AD0-2104-4786-B735-E92AE9587207
| -----------------------------------------------------------
| APFS Physical Store Disk: disk0s2
| Size: 999040462848 B (999.0 GB)
|
+-> Volume disk1s1 728909BE-B86A-3A8B-9748-5D71DC69DA0B
| ---------------------------------------------------
| APFS Volume Disk (Role): disk1s1 (No specific role)
| Name: Macintosh HD (Case-insensitive)
| Mount Point: Not Mounted
| Capacity Consumed: 959202942976 B (959.2 GB)
| Encryption Progress: 60.0% (Locked)
|
+-> Volume disk1s2 5E520A95-D69A-4F6F-84E4-7448E27492E4
| ---------------------------------------------------
| APFS Volume Disk (Role): disk1s2 (Preboot)
| Name: Preboot (Case-insensitive)
| Mount Point: Not Mounted
| Capacity Consumed: 4999376896 B (5.0 GB)
| Encrypted: No
|
+-> Volume disk1s3 BBFE1826-2FBF-4E16-8013-4EB7D72098AC
| ---------------------------------------------------
| APFS Volume Disk (Role): disk1s3 (Recovery)
| Name: Recovery (Case-insensitive)
| Mount Point: Not Mounted
| Capacity Consumed: 506667008 B (506.7 MB)
| Encrypted: No
|
+-> Volume disk1s4 4E4395FC-8E97-437C-A45A-68A1072E191F
---------------------------------------------------
APFS Volume Disk (Role): disk1s4 (VM)
Name: VM (Case-insensitive)
Mount Point: Not Mounted
Capacity Consumed: 2147586048 B (2.1 GB)
Encrypted: No
Marks-iMac:/ root#

How to start this app?

Hello,

would you be so kind and explain how to launch this app?

All the best,
George

No progress

Hello,
I tested your app, but no luck so far. (I run the latest OS X)
When clicking on "mount filevault volume" the process begins, but nothing happens: no advancement and pwd/sec stays 0. Changing wordlist or changing some options/threads does not change anything.

When clicking on "stop" the app will not quit, but stays forever in the status "quitting".

I need to go back to this version (commit10) in order to have a "working" app. This means, the app does its work but does not find the pwd wich was in the wordlist due to AKS error

B

macOS High Sierra

Hi, it’s me again.

I tried this app on macOS High Sierra. When I entered the UUID of core storage I got the message that it is not encrypted (it’s true), so I suppose that the app operates well in this OS.

Then I entered the UUID of my SSD (which is blocked by FileVault and connected to this MacBook via dock station) and got the same notification as earlier "UUID is not a valid CoreStorage volume UUID".

So the questions is: How to unblock external (not core) storage?

or

How to make my blocked SSD core storage if I cannot launch OS from it because I forgot this damn FileVault password and restoration via apple ID doesn’t work?

All the best

Mac Mojave

Entering the UUID of the encrypted drive partition, I get an error

UUID is not a valid CoreStorage volume UUID.

Any pointers on what I need to do to run the compiled app on the drive.

Thanks in advance

Derek

Requesting version for APFS

Please modify your project to be compatible for APFS. I have tried my own mods with no success. THANKS!!!

AKS Error

When trying to use your app to mount an encrypted filecracker volume, it keeps giving me this error:
AKS Error
Could not store a passphrase with ASK. Please start again with fewer threads. Note that you may need to restart your computer.

I've restarted it a few times, even lowered the amount of threads to 1, but every time it goes through maybe 80 passwords in the wordlist, it stops afterwards with this error.

I've tested it with a wordlist of 9 words and it did work (it went through the whole list), but otherwise it keeps giving this error.

I am running a macOS 10.14.1 Mojave on a VMWare workstation, and I'm not quite familiar with macOS.
If anything is needed additional, just tell me what should I attach and how.

Thank you in advance

Best way to connect Air

Im' trying to recover for a deceased co-worker's relative. I have a macbook air. What's the best way to connect and how do I get the UUID of the drive etc?

UUID is not a valid CoreStorage volume UUID

Hello,

I entered UUID of SSD which I extracted from my macbook and connected via docking station to another one where I installed FileVaultCracker. After a try to mount I got the notification "UUID is not a valid CoreStorage volume UUID".

If I understood correctly the programm needs UUID of the core storage (where operationing OS is) but unfortunately I can't launch FileVaultCracker on my macbook because it's blocked by FileVault password which I forgot.

I wonder you will recommend some solution because FileVaultCracker is my last hope.

All the best

APFS Support

Hello,
I was wondering if you were planning or considering to add support for APFS Encrypted drives to this tool?