从FileVault 2加密磁盘映像中提取用户名

Question

我正在处理使用File Vault 2加密的MacBook（Mac OS X 10.11.6）磁盘的比特流（dd）图像。我没有任何密码、密码或恢复密钥来解锁驱动器，但我对解锁/解密驱动器不感兴趣。

我只需要提取与登录屏幕相关的所有可能信息。该信息应包括允许登录的用户名和密码建议（如有）。对于密码建议，我指的是如果您单击问号（？）时可用的建议在密码框的右侧。

以下是登录屏幕的示例：

登录屏幕示例

据我所知，系统会启动一个特殊的EFI预启动，在其中显示FileVault 2解锁屏幕，其中包含已批准解锁磁盘的指定OS X帐户的图标。不应加密登录信息（用户名等），因为它们在您启动系统时和用户使用密码登录之前是可用和可见的（即磁盘尚未解锁）。

我还尝试通过附加图像然后使用sudo fdesetup list -device来获取此信息

以下是使用< code > HDI util attach-nomount/Volumes/USB/image . DD . dmg 附加磁盘映像(存储在外部USB驱动器中)后< code>diskutil list的输出:

/dev/disk0 (internal):
   #:                       TYPE NAME                    SIZE       IDENTIFIER
   0:      GUID_partition_scheme                         500.3 GB   disk0
   1:                        EFI EFI                     314.6 MB   disk0s1
   2:                 Apple_APFS Container disk1         500.0 GB   disk0s2

/dev/disk1 (synthesized):
   #:                       TYPE NAME                    SIZE       IDENTIFIER
   0:      APFS Container Scheme -                      +500.0 GB   disk1
                                 Physical Store disk0s2
   1:                APFS Volume Macintosh HD            143.2 GB   disk1s1
   2:                APFS Volume Preboot                 21.0 MB    disk1s2
   3:                APFS Volume Recovery                522.1 MB   disk1s3
   4:                APFS Volume VM                      1.1 GB     disk1s4

/dev/disk2 (external, physical):
   #:                       TYPE NAME                    SIZE       IDENTIFIER
   0:      GUID_partition_scheme                        *3.0 TB     disk2
   1:         Microsoft Reserved                         16.8 MB    disk2s1
   2:       Microsoft Basic Data TARGET                  3.0 TB     disk2s2

/dev/disk3 (disk image):
   #:                       TYPE NAME                    SIZE       IDENTIFIER
   0:      GUID_partition_scheme                        +121.3 GB   disk3
   1:                        EFI EFI                     209.7 MB   disk3s1
   2:          Apple_CoreStorage Macintosh HD            120.5 GB   disk3s2
   3:                 Apple_Boot Recovery HD             650.0 MB   disk3s3

Offline
                                 Logical Volume Macintosh HD on disk3s2
                                 UUUUUUUU-UUUU-UUUU-UUUU-UUUUUUUUUUUU
                                 Locked Encrypted

以下是＜code＞diskutil cs list＜code＞的输出：

CoreStorage logical volume groups (1 found)
|
+-- Logical Volume Group UUUUUUUU-UUUU-UUUU-UUUU-UUUUUUUUUUUU
    =========================================================
    Name:         Macintosh HD
    Status:       Online
    Size:         120473067520 B (120.5 GB)
    Free Space:   12656640 B (12.7 MB)
    |
    +-< Physical Volume UUUUUUUU-UUUU-UUUU-UUUU-UUUUUUUUUUUU
    |   ----------------------------------------------------
    |   Index:    0
    |   Disk:     disk3s2
    |   Status:   Online
    |   Size:     120473067520 B (120.5 GB)
    |
    +-> Logical Volume Family UUUUUUUU-UUUU-UUUU-UUUU-UUUUUUUUUUUU
        ----------------------------------------------------------
        Encryption Type:         AES-XTS
        Encryption Status:       Locked
        Conversion Status:       Complete
        High Level Queries:      Fully Secure
        |                        Passphrase Required
        |                        Accepts New Users
        |                        Has Visible Users
        |                        Has Volume Key
        |
        +-> Logical Volume XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX
            ---------------------------------------------------
            Disk:                  -none-
            Status:                Locked
            Size (Total):          120108089344 B (120.1 GB)
            Revertible:            Yes (unlock and decryption required)
            LV Name:               Macintosh HD
            Content Hint:          Apple_HFS

如果我尝试fdesetup命令，我会得到以下错误：

$ fdesetup status -device XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX
Error: The -device option is not allowed for this operation.

每次尝试使用其他 UUID 都会导致以下错误：错误：指定的卷或设备“UUUUUUUU-UUUU-UUUU-UUUU-UUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUU

最后，问题是“如何从使用文件库2加密的磁盘映像中提取登录信息（而不是密码）”。基于输入密码前该信息的可用性，我假设用户名以及其他信息（例如密码提示）未加密，可以从磁盘映像中提取。

期待您的反馈。

非常感谢。戈斯特普

Answer 1

在其中一个分区上，你会发现一个“预引导”目录。该目录包含一个具有唯一编号的目录，例如52C97122313-4B77-...在这个目录中，有目录“var ”,有目录“db”。在这里，您可以找到包含所需信息的plist文件CryptoUserInfo.plist。

/Preboot/52C97122313-4B77.../var/db/CryptoUserInfo.plist

可以使用文本编辑器显示值