/libfvde

Library and tools to access FileVault Drive Encryption (FVDE) encrypted volumes
  1. C 72.8%
  2. M4 17.4%
  3. Shell 4.0%
  4. Python 1.7%
  5. Makefile 1.6%
  6. PowerShell 0.9%
  7. Other 1.6%
C M4 Shell Python Makefile PowerShell Other
Clone or download

Clone with HTTPS

Use Git or checkout with SVN using the web URL.

Open in Desktop Download ZIP
Find file
Switch branches/tags
Nothing to show
Latest commit 3584a32 Jan 8, 2018 @joachimmetz joachimmetz Worked on tests
Permalink
Failed to load latest commit information.
common Applied updates Jan 8, 2018
documentation Worked on format support and applied updates Oct 8, 2017
dpkg Applied updates Jan 8, 2018
fvdetools Applied updates Jan 8, 2018
include Applied updates Jan 8, 2018
libfvde Worked on tests Jan 8, 2018
m4 Applied updates Jan 8, 2018
manuals Applied updates Jan 8, 2018
msvscpp Worked on tests Oct 20, 2017
po Worked on tests Nov 3, 2016
pyfvde-python2 Moved libcstring macros to common Nov 9, 2016
pyfvde-python3 Moved libcstring macros to common Nov 9, 2016
pyfvde Worked on tests Jan 8, 2018
tests Worked on tests Jan 8, 2018
.codecov.yml Worked on tests Oct 20, 2017
.gitignore Worked on format support and applied updates Oct 8, 2017
.travis.yml Applied updates Nov 29, 2017
AUTHORS Applied updates Jan 8, 2018
COPYING Initial commit of version 20141018. Oct 18, 2014
ChangeLog Worked on tests Nov 3, 2016
Makefile.am Removed libcsystem dependency and worked on dpkg files May 27, 2017
NEWS Initial commit of version 20141018. Oct 18, 2014
README Changes to README Aug 1, 2016
acinclude.m4 Worked on tests Sep 19, 2017
appveyor.yml Worked on format support and applied updates Oct 8, 2017
autogen.ps1 Worked on tests Nov 10, 2016
autogen.sh Worked on tests Aug 27, 2017
configure.ac Applied updates Jan 8, 2018
libfvde.ini Worked on tests Oct 20, 2017
libfvde.pc.in Moved libcstring macros to common Nov 9, 2016
libfvde.spec.in Worked on tests Oct 20, 2017
runtests.ps1 Moved libcstring macros to common Nov 9, 2016
runtests.sh Applied updates Dec 17, 2017
setup.py Applied updates Nov 29, 2017
synclibs.ps1 Worked on tests Aug 27, 2017
synclibs.sh Worked on tests Oct 7, 2017
syncsharedlibs.sh Worked on tests Oct 7, 2017
syncwinflexbison.ps1 Worked on tests Jan 8, 2018
synczlib.ps1 Applied updates Nov 29, 2017

README 

libfvde is a library to access FileVault Drive Encryption (FVDE) (or FileVault2) encrypted volumes.

The FVDE format is used by Mac OS X, as of Lion, to encrypt data on a storage media volume.

Project information:

* Status: experimental
* Licence: LGPLv3+

Supported FileVault2 implementations:

* Mac OS X Lion (10.7)
* Mac OS X Mountain Lion (10.8)
* Mac OS X Mavericks (10.9)
* Mac OS X Yosemite (10.10)
* Mac OS X El Capitan (10.11)

Supported encryption volume types:

* removable media volume - with encrypted context (initial support as of 20121113 version)
* system volume

Supported protection methods:

* password
* recovery password
* VMK key data (as of 20121114 version)

Also see:

* VileFault; for accessing FileVault encrypted disk images (or user directories): https://code.google.com/p/vilefault/
* Infiltrate the Vault: Security Analysis and Decryption of Lion Full Disk Encryption: http://eprint.iacr.org/2012/374.pdf
* Security Analysis and Decryption of FileVault 2: http://www.cl.cam.ac.uk/~osc22/docs/slides_fv2_ifip_2013.pdf

If you find this project useful please cite the following paper in your publications:
Omar Choudary, Felix Grobert and Joachim Metz. "Security Analysis and Decryption of Filevault 2",
in Advances in Digital Forensics IX, IFIP Advances in Information and Communication Technology 410,
2013, pp 349-363.

Work in progress:

* DEFLATE compressed XML plist
* removable media volume - without encrypted context
* removable media volume - decrypted
* extend CoreStorage volume support
* partial encrypted volumes

Planned:

* Dokan support

For more information see:

* Project documentation: https://github.com/libyal/libfvde/wiki/Home
* How to build from source: https://github.com/libyal/libfvde/wiki/Building