Library and tools to access FileVault Drive Encryption (FVDE) encrypted volumes
C M4 C++ Shell Makefile PowerShell Other
Latest commit ea89241 Feb 5, 2017 @joachimmetz joachimmetz Applied updates
Permalink
Failed to load latest commit information.
common Applied updates Feb 5, 2017
documentation Worked on format support. Aug 1, 2016
dpkg Applied updates Feb 5, 2017
fvdetools Applied updates Feb 5, 2017
include Applied updates Feb 5, 2017
libfvde Applied updates Feb 5, 2017
m4 Moved libcstring macros to common Nov 9, 2016
manuals Applied updates Feb 5, 2017
msvscpp Worked on tests Nov 10, 2016
po Worked on tests Nov 3, 2016
pyfvde-python2 Moved libcstring macros to common Nov 9, 2016
pyfvde-python3 Moved libcstring macros to common Nov 9, 2016
pyfvde Applied updates Feb 5, 2017
tests Applied updates Feb 5, 2017
.codecov.yml Worked on tests. Sep 4, 2016
.gitignore Moved libcstring macros to common Nov 9, 2016
.travis.yml Worked on tests Nov 3, 2016
AUTHORS Applied updates Feb 5, 2017
COPYING Initial commit of version 20141018. Oct 18, 2014
ChangeLog Worked on tests Nov 3, 2016
Makefile.am Moved libcstring macros to common Nov 9, 2016
NEWS Initial commit of version 20141018. Oct 18, 2014
README Changes to README Aug 1, 2016
acinclude.m4 Moved XML plist support to libfplist Nov 4, 2016
appveyor.yml Worked on tests Nov 10, 2016
autogen.ps1 Worked on tests Nov 10, 2016
autogen.sh Applied updates. Jan 8, 2016
configure.ac Worked on tests Nov 10, 2016
libfvde.ini Code clean up Nov 4, 2016
libfvde.pc.in Moved libcstring macros to common Nov 9, 2016
libfvde.spec.in Moved libcstring macros to common Nov 9, 2016
runtests.ps1 Moved libcstring macros to common Nov 9, 2016
runtests.sh Worked on tests Nov 3, 2016
setup.py Worked on tests. May 15, 2016
synclibs.ps1 Worked on tests Nov 10, 2016
synclibs.sh Worked on tests Nov 10, 2016
syncwinflexbison.ps1 Updated Windows scripts. Sep 18, 2016
synczlib.ps1 Changes to AppVeyor configuration. Jul 31, 2016

README

libfvde is a library to access FileVault Drive Encryption (FVDE) (or FileVault2) encrypted volumes.

The FVDE format is used by Mac OS X, as of Lion, to encrypt data on a storage media volume.

Project information:

* Status: experimental
* Licence: LGPLv3+

Supported FileVault2 implementations:

* Mac OS X Lion (10.7)
* Mac OS X Mountain Lion (10.8)
* Mac OS X Mavericks (10.9)
* Mac OS X Yosemite (10.10)
* Mac OS X El Capitan (10.11)

Supported encryption volume types:

* removable media volume - with encrypted context (initial support as of 20121113 version)
* system volume

Supported protection methods:

* password
* recovery password
* VMK key data (as of 20121114 version)

Also see:

* VileFault; for accessing FileVault encrypted disk images (or user directories): https://code.google.com/p/vilefault/
* Infiltrate the Vault: Security Analysis and Decryption of Lion Full Disk Encryption: http://eprint.iacr.org/2012/374.pdf
* Security Analysis and Decryption of FileVault 2: http://www.cl.cam.ac.uk/~osc22/docs/slides_fv2_ifip_2013.pdf

If you find this project useful please cite the following paper in your publications:
Omar Choudary, Felix Grobert and Joachim Metz. "Security Analysis and Decryption of Filevault 2",
in Advances in Digital Forensics IX, IFIP Advances in Information and Communication Technology 410,
2013, pp 349-363.

Work in progress:

* DEFLATE compressed XML plist
* removable media volume - without encrypted context
* removable media volume - decrypted
* extend CoreStorage volume support
* partial encrypted volumes

Planned:

* Dokan support

For more information see:

* Project documentation: https://github.com/libyal/libfvde/wiki/Home
* How to build from source: https://github.com/libyal/libfvde/wiki/Building