Tribal Chicken

Security. Malware Research. Digital Forensics.

  • Home
  • About
  • Contact

Extracting FileVault 2 Keys with Volatility

Thomas White • 13 Feb 2016 • Tags: filevault, forensics, infosec, memory, security, volatility

This is a volatility plugin which can recover FileVault 2 Volume Master Keys from memory, based on a certain pattern. It has been briefly tested on OS X 10.9 – 10.11. Plugin on GitHub here. This is a Volatility Framework plugin which is capable of recovering the Volume Master Keys for volumes protected with… leer más

Hunting malware through memory analysis

Thomas White • 27 Apr 2015 • Tags: analysis, malware, memory, rovnix, volatility

A word of warning… Lots of screenshots in this post. Update 10/05/2015: I’ve updated the article with more information about some of the commands used in order to help out people who aren’t familiar with Volatility. When hunting a piece of malware it can be very interesting to have a poke… leer más

Page 1 of 1

About

I'm an Australian who does tech and security stuff. When not at my full-time job, I do independent DFIR / InfoSec / Malware research.

This site acts as an informal outlet for some of my personal work.

Most popular articles:

  1. Recovering BitLocker Keys on Windows 8.1 and 10: A brief touch on how the changes to BitLocker after
  2. Extracting FileVault 2 Keys with Volatility: This is a volatility plugin which can recover FileVault 2
  3. Automated Malware Analysis: mail server -> Cuckoo, V2.0: Quite some time ago I slapped together a couple of
  4. Hunting malware through memory analysis: A word of warning… Lots of screenshots in this post.

Disclaimer: The views expressed here are my own and do not necessarily reflect those of my current or past employers, affiliations, cats, etc.

Powered by: Ghost, Nginx and FreeBSD. Content powered by coffee. Ideas powered by beer, which you are welcome to donate if I've helped you.