GitHub - libyal/libfvde: Library and tools to access FileVault Drive Encryption (FVDE) encrypted volumes

libyal / libfvde Public

Notifications You must be signed in to change notification settings
Fork 35
Star 349

Library and tools to access FileVault Drive Encryption (FVDE) encrypted volumes

LGPL-3.0, GPL-3.0 licenses found

Licenses found

349 stars 35 forks Branches Tags Activity

Star

Notifications

Branches Tags

Name		Name	Last commit message	Last commit date
Latest commit History 207 Commits
.github/workflows		.github/workflows
common		common
documentation		documentation
dpkg		dpkg
fvdetools		fvdetools
include		include
libfvde		libfvde
m4		m4
manuals		manuals
msvscpp		msvscpp
ossfuzz		ossfuzz
po		po
pyfvde		pyfvde
tests		tests
.codecov.yml		.codecov.yml
.gitignore		.gitignore
AUTHORS		AUTHORS
COPYING		COPYING
COPYING.LESSER		COPYING.LESSER
ChangeLog		ChangeLog
Makefile.am		Makefile.am
NEWS		NEWS
README		README
acinclude.m4		acinclude.m4
appveyor.yml		appveyor.yml
autogen.ps1		autogen.ps1
autogen.sh		autogen.sh
build.ps1		build.ps1
builddokan.ps1		builddokan.ps1
configure.ac		configure.ac
libfvde.ini		libfvde.ini
libfvde.pc.in		libfvde.pc.in
libfvde.spec.in		libfvde.spec.in
pyproject.toml		pyproject.toml
runtests.ps1		runtests.ps1
runtests.sh		runtests.sh
setup.cfg.in		setup.cfg.in
setup.py		setup.py
syncdokan.ps1		syncdokan.ps1
synclibs.ps1		synclibs.ps1
synclibs.sh		synclibs.sh
synctestdata.ps1		synctestdata.ps1
synctestdata.sh		synctestdata.sh
syncwinflexbison.ps1		syncwinflexbison.ps1
synczlib.ps1		synczlib.ps1
tox.ini		tox.ini

Repository files navigation

libfvde is a library to access FileVault Drive Encryption (FVDE) (or FileVault2) encrypted volumes.

The FVDE format is used by Mac OS X, as of Lion (10.7), to encrypt data on a storage media volume.

Project information:

* Status: experimental
* Licence: LGPLv3+

Supported Core Storage / FileVault2 implementations:

* Mac OS X Lion (10.7)
* Mac OS X Mountain Lion (10.8)
* Mac OS X Mavericks (10.9)
* Mac OS X Yosemite (10.10)
* Mac OS X El Capitan (10.11)
* macOS Sierra (10.12)
* macOS High Sierra (10.13)
* macOS Mojave (10.14)
* macOS Catalina (10.15)

Supported encryption volume types:

* removable media volume - with encrypted context (initial support as of 20121113 version)
* system volume
* multiple logical volumes

Supported protection methods:

* password
* recovery password
* VMK key data (as of 20121114 version)

Unsupported Core Storage format features:

* multiple physical volumes

Also see:

* VileFault; for accessing FileVault encrypted disk images (or user directories): https://code.google.com/p/vilefault/
* Infiltrate the Vault: Security Analysis and Decryption of Lion Full Disk Encryption: http://eprint.iacr.org/2012/374.pdf
* Security Analysis and Decryption of FileVault 2: http://www.cl.cam.ac.uk/~osc22/docs/slides_fv2_ifip_2013.pdf

If you find this project useful please cite the following paper in your publications:
Omar Choudary, Felix Grobert and Joachim Metz. "Security Analysis and Decryption of Filevault 2",
in Advances in Digital Forensics IX, IFIP Advances in Information and Communication Technology 410,
2013, pp 349-363.

Work in progress:

* DEFLATE compressed XML plist
* removable media volume - without encrypted context
* removable media volume - decrypted
* extend CoreStorage volume support
* partial encrypted volumes

Planned:

* Dokan support

For more information see:

* Project documentation: https://github.com/libyal/libfvde/wiki/Home
* How to build from source: https://github.com/libyal/libfvde/wiki/Building