libyal/libfvde

unable to retrieve ConversionInfo key

grighi opened this issue · 4 comments

I'm trying to unlock an external drive encrypted last week. It wasn't encrypted on my machine, so I'm not sure which version of OSX or filevault was used in the encryption. In any case, here is what I'm getting:

[giovanni@arch libfvde-20160918]$ sudo fvdemount -p ValidPass /dev/sda2 /mnt/fvdevolume/ 
fvdemount 20160918

Unable to open: /dev/sda2.
libfvde_encryption_context_plist_read_xml: unable to retrieve ConversionInfo key.
libfvde_encryption_context_plist_set_data: unable to retrieve XML.
libfvde_encrypted_metadata_read_type_0x0019: unable to set encryption context plist data.
libfvde_encrypted_metadata_read: unable to read metadata block type 0x0019.
libfvde_volume_open_read: unable to read primary encrypted metadata.
libfvde_volume_open_file_io_handle: unable to read from file IO handle.
mount_handle_open_input: unable to open input volume.

And here is my debug_output.txt

thx, I'll have a look at soon as time permits.

<dict ID="0">
  <key>DefaultEncryptionContext</key>
  <integer size="32" ID="1">0x1</integer>
  <key>com.apple.corestorage.lvf.groupUUID</key>
  <string ID="2">CEE72CB7-8F3D-4279-AD83-4B8ABAFC8B34</string>
  <key>com.apple.corestorage.lvf.sequence</key>
  <integer size="32" ID="3">0x2</integer>
  <key>com.apple.corestorage.lvf.uuid</key>
  <string ID="4">66E6244E-800E-47B7-83E3-53423643068F</string>
  <key>PreviousEncryptionContext</key>
  <integer size="32" ID="5">0x0</integer>
  <key>com.apple.corestorage.lvf.advertisedBlkSizes</key>
  <integer size="32" ID="6">0x1</integer>
  <key>com.apple.corestorage.lvf.encryption.type</key>
  <string ID="7">AES-XTS</string>
  <key>com.apple.corestorage.lvf.encryption.status</key>
  <string ID="8">Unlocked</string>
</dict>

So ConversionInfo is not present in this plist. Added reminder to make it optional in #2. Closing this issue

Note that this plist also does not have CryptoUsers and WrappedVolumeKeys