Is there any facility to use a hardware-backed key from SecureEnclave inside the guest OS? Does anyone know if Parallels might expose the key generation and encryption features of Secure Enclave to a python script or even some C code running inside an Ubuntu guest OS? I'd like to be able to claim that my Parallels-hosted Python app is using the built-in algorithms and key extraction prevention inherent in an HSM.

Whenever I'm logged in as a certain user and trigger a shutdown or restart, I get prompted to enable FileVault. - I have searched everywhere to find the hook that causes this prompt, but I can't find it. - I've searched all the LaunchDaemon and LaunchAgent directories I can find. - I've reviewed the output of launchctl find. - I've done other things in the past as well but I don't remember them all. - I have upgraded my computer and transferred my user account multiple times since this started happening. It seems to stick to my user account. - I believe this might have come from Symantec Endpoint Encryption that was installed by my employer many years ago. But I've also tried all the uninstaller techniques I can find for that. It appears after all the desktop stuff has gone away. Any ideas for where else I can look for a hook that might trigger this? Update: **FileVault** is not currently enabled on the disk and I do not want to enable it. ![Screenshot of the FileVault dialog box saying 'To add this user to FileVault, enter the password for 'cquenell.'' ][1]

I know there have been various questions asked on this topic before, but I haven't seen a question that focused specifically on whether data from a factory reset iPhone could be recovered if **a passcode** was not used. Apple states on their website "Setting a passcode also **turns on data protection**, which encrypts your iPhone data with 256-bit AES encryption". (https://support.apple.com/en-gb/guide/iphone/iph14a867ae/ios) Therefore, if someone decided to not set a passcode on their iPhone and then reset their iPhone at a later date, would the data on their phone then be unencrypted and thus recoverable by a third party?

I have a USB hard drive that I want to use as my Time Machine backup disk. I want it to be encrypted. If I partition it as an encrypted disk, it finishes fine; but then if I run First Aid, it says it's corrupt. If I partition it UNencrypted, First Aid says it's fine. I've repeated it multiple times. Encrypted = corrupt. Unencrypted = okay. Why would the disk only read as corrupt when encrypted? Running OS 10.15 on a 2014 MacBook This is the First Aid log when I get the error. If it's unencrypted, it's short and sweet -- all "okay". Running First Aid on “WD easystore 25FA Media” (disk2) Checking prerequisites Checking the partition list Checking the partition map size Checking for an EFI system partition Checking the EFI system partition’s size Checking the EFI system partition’s file system Checking the EFI system partition’s folder content Checking all HFS data partition loader spaces Checking booter partitions Checking booter partition disk2s3 Verifying file system. Volume is already unmounted. Performing fsck_hfs -fn -x /dev/rdisk2s3 Checking Journaled HFS Plus volume. Checking extents overflow file. Checking catalog file. Checking multi-linked files. Checking catalog hierarchy. Checking extended attributes file. Checking volume bitmap. Checking volume information. The volume Boot OS X appears to be OK. File system check exit code is 0. Restoring the original state found as unmounted. Checking Core Storage Physical Volume partitions Verifying storage system Performing fsck_cs -n -x --lv --uuid 0AD74A3C-D0D6-42F5-B0D4-9FB8486ABC99 Checking volume disk2s2: Scan for Volume Headers disk2s2: Scan for Disk Labels Logical Volume Group 0AD74A3C-D0D6-42F5-B0D4-9FB8486ABC99 on 1 device disk2s2: Scan for Metadata Volume Logical Volume Group has a 24 MB Metadata Volume with double redundancy Start scanning metadata for a valid checkpoint Load and verify Segment Headers Load and verify Checkpoint Payload Load and verify Transaction Segment Load and verify Transaction Segment Incorporate 1 newer non-checkpoint transaction Load and verify Virtual Address Table Load and verify Segment Usage Table Load and verify Metadata Superblock Load and verify Logical Volumes B-Trees Logical Volume Group contains 1 Logical Volume Load and verify 2C6C36E4-9E7A-433B-847C-BEE4D39BFBF2 Load and verify B8B932A7-B825-48D5-A577-5485DDD0DE76 Load and verify Freespace Summary Load and verify Block Accounting Blocks on device 26EC24D8-82B4-4CA5-B361-FB2194641A72 are not accounted for by CoreStorage Unable to bootstrap transaction group 6: inconsistent crosscheck Continue scanning metadata for an older checkpoint Load and verify Segment Headers Load and verify Checkpoint Payload Load and verify Transaction Segment Incorporate 0 newer non-checkpoint transactions Load and verify Virtual Address Table Load and verify Segment Usage Table Load and verify Metadata Superblock Load and verify Logical Volumes B-Trees Logical Volume Group contains 0 Logical Volumes Load and verify Freespace Summary Load and verify Block Accounting Blocks on device 26EC24D8-82B4-4CA5-B361-FB2194641A72 are not accounted for by CoreStorage Unable to bootstrap transaction group 5: inconsistent crosscheck Continue scanning metadata for an older checkpoint Load and verify Segment Headers Load and verify Checkpoint Payload Load and verify Transaction Segment Incorporate 0 newer non-checkpoint transactions Load and verify Virtual Address Table Load and verify Segment Usage Table Load and verify Metadata Superblock Load and verify Logical Volumes B-Trees Logical Volume Group contains 0 Logical Volumes Load and verify Freespace Summary Load and verify Block Accounting Blocks on device 26EC24D8-82B4-4CA5-B361-FB2194641A72 are not accounted for by CoreStorage Unable to bootstrap transaction group 4: inconsistent crosscheck Continue scanning metadata for an older checkpoint Load and verify Segment Headers Load and verify Checkpoint Payload Load and verify Transaction Segment Incorporate 0 newer non-checkpoint transactions Load and verify Virtual Address Table Load and verify Segment Usage Table Load and verify Metadata Superblock Load and verify Logical Volumes B-Trees Logical Volume Group contains 0 Logical Volumes Load and verify Freespace Summary Load and verify Block Accounting Blocks on device 26EC24D8-82B4-4CA5-B361-FB2194641A72 are not accounted for by CoreStorage Unable to bootstrap transaction group 3: inconsistent crosscheck No valid commit checkpoint found The volume 0AD74A3C-D0D6-42F5-B0D4-9FB8486ABC99 was found corrupt and needs to be repaired Storage system check exit code is 1. Problems were found with the partition map which might prevent booting Storage system verify or repair failed. : (-69716) Operation successful.

**Problem**: I need to get passwords from Microsoft Edge browser, but they are encrypted. How can I get them? **Context**: I have issue with my Macbook - when I start it and trying to login - it's rebooted. So I cannot login via UI. But I can login to it via ssh, but it is also not stable, and can reboot after random time. It's Macbook Pro 2016, intel chip, MacOS 12.15 **Important notes:** 1. MS Edge cannot be opened or updated 2. Only SSH access (no UI) 3. I DO know user password 4. I don't have brew or python installed and it is impossible to install them on broken machine. 5. No iCloud sync, internal MS Edge sync, or Time Machine 6. I've already tried recovery / safe boot, it was not able to bring system back, so please don't suggest it 7. I have backup of "~/Library/Application\ Support/Microsoft Edge/Default/Login Data" (that is sqlite database). It is near 160 kilobytes 8. All passwords_values in database have length of 19 bytes, started with v10 9. After hex decoding they are like 7631304EEB2799F876E96056BAB04A9B7C8458 10. PRAGMA integrity_check; on "Login Data" returns "ok" 11. I was able to extract password for "Microsoft Edge Safe Storage" keychain item - it is like aA5P+D9dEVYFpabCde3xyz== and it is 100% correct 12. Claude and ChatGPT sure that it's encrypted with AES-GCM, but password is too short for it. Also they gave a lot of python scripts to decrypt, but no of them are actually decrypted right. 13. On the new Macbook 2021 (M1) with Sequoia 15.5 password length in "Login Data" is also 19 bytes 14. https://github.com/moonD4rk/HackBrowserData didn't start (any version) 15. Result of SELECT * FROM meta; for "Login Data" database is

mmap_status|-1
logins_edge_extended_table_version|3
last_compatible_version|40
version|41
edge_breached_table_version|4

I turned my FileVault off (yes big mistake) without researching anything. I don't know what made me turn it off brain fart or curiosity maybe. t was all okay until the decryption reached 99% when I plug in my laptop to the charger, My laptop restarts on its own, is it supposed to do that? The battery drains fast when I try to use my laptop (charger unplugged). I have tried disabling and enabling it from terminal but it ends up only showing this

$ sudo fdesetup disable
Password:
Enter the user name://
Enter the password for user '//':
FileVault was not disabled (2).


$ fdesetup status
FileVault is On.
Decryption in progress: Percent completed = 99

I don't know how to fix it or what to do, I'm not sure if it's supposed to do that.

I recently attempted to clone a failing external drive to a new external drive. The clone failed part-way into the process. The original drive hardware has now fully failed, so I'm trying to recover as much as I can from the clone. When I plug in the clone, macOS gives me an error reading "The disk 'Volume_Name' can't be unlocked. A problem was detected with the disk that prevents it from being unlocked." Disk Utility shows 1.6 TB used. I tried unlocking it from the command line and the Terminal output was Passphrase incorrect or user does not exist. I am certain I'm entering the passphrase correctly. A scan in Data Rescue shows a recognizable list of files and folders. I can copy a file from the clone, but I can't open it. I am guessing that the files are encrypted individually while the folder structure is not. From my research, macOS creates a separate cryptouser on an encrypted disk (separate from a Mac account/user) so that one password can open the disk on any Mac. When I used diskutil apfs listcryptousers /dev/Volume_Name in Terminal, the output is No cryptographic users for Volume_Name when it *should* output something like this: I believe I've recovered the clone volume's cryptouser string from Keychain Access on two separate Macs (they match), so I have both the user and the passphrase. Is there a way to enter these manually and decrypt the drive? Either via the Terminal or a third-party piece of software? For reference, I got a lot of information from this page even though it outlines boot drives instead of external ones. Thank you in advance!

I deleted MacBook Pro's disk, reinstall of Sonoma, Time Machine Backup is on a Synology DS My Time Machine Backups are password protected with the mechanism used by MacOS or Time Machine itself. I put in the wrong password when trying to add the Time Machine Volume. First it gave me something like "wrong password" and then it gave me the error in the title. How can I access this password-protected backup?

I wanted to create a copy/clone of an encypted partition to another drive. I had (apparently incorrectly) assumed that simply selecting the partition in Disk Utility and hitting restore would do the trick, no such luck. Instead, it copied over the data **unencrypted**. So, how can I copy the partition (keeping the encryption) via Disk Utility (or maybe there is a command-line option?). The source partition in question contains a Time Machine backup, so a "normal" file copy wouldn't work. dd won't work either, since the destination is larger than the source (or at least every time I tried to dd a smaller partition onto a larger one I could never get the partition to expand).

Is it better to encrypt the hard drive you will use for Time Machine backup with Disk Utility or with Time Machine itself? I have noticed the the dialogue is slightly different, wherein Disk Utility a hint is not required, but with Time Machine it is... are there any other differences under the hood?

When deciding on whether to store my backups encrypted or not I have to weigh the risk of potential damage of my backup drives being **stolen and readable**, and the potential damage of my backup becoming unreadable through various forms of "natural" **degradation** of the hardware and data. I want to make an informed decision but I don't even know how vulnerable the encrypted backups are to e.g. single-bit corruption compared to unencrypted ones. If I let Time Machine encrypt a backup (onto an unencrypted target APFS volume -- if these two encryption schemes happen to be distinct) **will all of the backup be inaccessible in the case of a single bit flip of the encrypted data?** I'm guessing it could be if the corruption occurs in the wrong part of the data structure, but in general, will most of its content still be readable? In other words, will it simply leave a few damaged files out of a future restore operation? Let's assume I'm using a modern Time Machine implementation of Sequoia 15.3 and the target volume is APFS. I'll add that I currently don't know if Time Machine simply uses APFS' encryption capabilities or whether it does its own thing.

I installed a configuration profile from NextDNS on my macOS machine to encrypt and track DNS queries and set my Ethernet DNS servers to localhost (:: and 127.0.0.1) to ensure nothing can bypass it, but it appears that macOS will repeatedly make unencrypted DNS queries for mask-api.icloud.com (over port 53) anyway. (I can see the unencrypted lookup attempts to localhost via Wireshark.) (Note: mask-api.icloud.com is blocked via NextDNS.) Further, these A and AAAA queries for mask-api.icloud.com are paired with inexplicable PTR queries for lb._dns-sd._udp.0.0.168.192.in-addr.arpa and 0.0.168.192.in-addr.arpa. I’m wondering if this behavior is considered normal, an Apple bug, or a sign of malware and if there’s some way to disable the undesired queries in macOS. (Note: Private Relay is off since I don’t use an iCloud account on macOS and the “limit tracking” feature is also off for the Ethernet connection.) (Also concerning is that if this behavior is in iOS too, then it’s presumably not actually possible to block iCloud masking or encrypt all DNS requests on a mobile network via a configuration profile since iOS doesn’t seem to provide any other way to control mobile network DNS servers (i.e., I can’t blackhole the requests to localhost).)

Is there any disk encryption scheme or format that can be used on both macos _and_ linux? Linux cannot read Apple's drive encryption format, and LUKS is not supported on MacOS. I tried using VeraCrypt encrypted partitions in exFat format and it mounted successfully several times on MacOS but after a system update exFat mounting of veracrypt volumes does not work anymore (no issues on linux). Also, exFat does not seem to be a reliable file system, so I searched for alternatives, but apart from **fat32**, **exFat** and **ntfs** I don't see any viable alternatives for a reliable cross-platform file system. All of these formats have issues: **fat32** has file size limits, **exfat** veracrypt partitions are not mountable on macos, and **ntfs** is proprietary, linux support is not reliable, and veracrypt does not support it on linux/mac. hfsplus works fine on mac but is read-only on linux (probably worth mentioning that you can disable HFS+ journalling and allow writing on linux). I hoped to be able to use ext3/ext4 with veracrypt encryption but even though I have fuse with ext4fuse working in read-only mode working for unencrypted drives veracrypt is apparently not able to interoperate with fuse drivers. Fat32 would be a great option since it works well with veracrypt on any OS, but the file size limitation and lack of symlinks is simply not acceptable. Any other options I might have missed?

I've noticed a sort-of lazy/post encryption strategy in MacOS/OS X with FileVault enabled and in encrypted Time Machine backups, and I'm curious when actual encryption happens. - When I copy videos from unencrypted external USB 3 volumes to my FileVault encrypted volume, my write speeds are 100+MB/s. However, I don't think my macbook (Intel Core i7-4980) is capable of encrypting that fast on-the-fly. - When I complete a time machine backup, a lengthy "encrypting..." step happens, but continues seamlessly after un-mounting/re-mounting. This is more obvious when encryption is happening, but is the data exposed until encryption is complete? **When does the actual encryption happen? Is there a period of time where my files are vulnerable unencrypted?**

I have an external disk that's APFS-encrypted which suddenly won't mount/unlock: $ diskutil apfs unlockVolume /dev/disk7s1 -nomount Passphrase: Unlocking any cryptographic user on APFS Volume disk7s1 Passphrase incorrect or user does not exist I also can't modify the APFS container from Disk Utility to add any new volumes. I thought maybe corruption had led to my password no longer unlocking the files, but I downloaded DiskDrill, supplied it with my password and let it scan for files and it actually found them! I'm wondering if that means the partition table is messed up or something, because obviously the passphrase is still decrypting the files. I don't have enough disk space on hand to recover these files and re-create the APFS volume right now - any help would be appreciated. I've tried to interpret these hex dumps using GPT header and table lookup information but I'm not making much progress. Edit 1: I've added fsck_apfs output, and I think the issue is the space manager data in the container, not the volume itself. I would be happy to roll this container back to a different, healthier checkpoint but I'm not sure how. **Diskutil** $ diskutil list [...] /dev/disk6 (internal, physical): #: TYPE NAME SIZE IDENTIFIER 0: GUID_partition_scheme *1.0 TB disk6 1: EFI EFI 209.7 MB disk6s1 2: Apple_APFS Container disk7 1.0 TB disk6s2 /dev/disk7 (synthesized): #: TYPE NAME SIZE IDENTIFIER 0: APFS Container Scheme - +1.0 TB disk7 Physical Store disk6s2 1: APFS Volume Storage 419.8 GB disk7s1 **GPT** $ sudo gpt -r show disk7 start size index contents 0 1 PMBR 1 1 Pri GPT header 2 32 Pri GPT table 34 6 40 409600 1 GPT part - C12A7328-F81F-11D2-BA4B-00A0C93EC93B 409640 1954135984 2 GPT part - 7C3457EF-0000-11AA-AA11-00306543ECAC 1954545624 7 1954545631 32 Sec GPT table 1954545663 1 Sec GPT header **GPT Header** $ sudo dd if=/dev/disk6 bs=512 count=1 skip=1 | hexdump -Cv 00000000 45 46 49 20 50 41 52 54 00 00 01 00 5c 00 00 00 |EFI PART....\...| 00000010 05 ac dd 9f 00 00 00 00 01 00 00 00 00 00 00 00 |................| 00000020 ff ff 7f 74 00 00 00 00 22 00 00 00 00 00 00 00 |...t....".......| 00000030 de ff 7f 74 00 00 00 00 86 e8 09 f7 47 a3 31 48 |...t........G.1H| 00000040 ab b1 17 2f 5e b4 24 6e 02 00 00 00 00 00 00 00 |.../^.$n........| 00000050 80 00 00 00 80 00 00 00 2b 1a b5 ae 00 00 00 00 |........+.......| 00000060 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| 00000070 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| 00000080 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| 00000090 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| 000000a0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| 000000b0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| 000000c0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| 000000d0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| 000000e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| 000000f0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| 00000100 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| 00000110 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| 00000120 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| 00000130 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| 00000140 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| 00000150 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| 00000160 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| 00000170 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| 00000180 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| 00000190 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| 000001a0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| 000001b0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| 000001c0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| 000001d0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| 000001e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| 000001f0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| 00000200 **GPT Table** $ sudo dd if=/dev/disk6 bs=512 count=1 skip=2 | hexdump -Cv 00000000 28 73 2a c1 1f f8 d2 11 ba 4b 00 a0 c9 3e c9 3b |(s*......K...>.;| 00000010 27 f8 f8 1b af 49 81 44 99 e7 32 45 65 64 2b ee |'....I.D..2Eed+.| 00000020 28 00 00 00 00 00 00 00 27 40 06 00 00 00 00 00 |(.......'@......| 00000030 00 00 00 00 00 00 00 00 45 00 46 00 49 00 20 00 |........E.F.I. .| 00000040 53 00 79 00 73 00 74 00 65 00 6d 00 20 00 50 00 |S.y.s.t.e.m. .P.| 00000050 61 00 72 00 74 00 69 00 74 00 69 00 6f 00 6e 00 |a.r.t.i.t.i.o.n.| 00000060 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| 00000070 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| 00000080 ef 57 34 7c 00 00 aa 11 aa 11 00 30 65 43 ec ac |.W4|.......0eC..| 00000090 c1 c6 8d 57 81 82 e9 4c a3 7d fa d0 2f b7 bd 74 |...W...L.}../..t| 000000a0 28 40 06 00 00 00 00 00 d7 ff 7f 74 00 00 00 00 |(@.........t....| 000000b0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| 000000c0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| 000000d0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| 000000e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| 000000f0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| 00000100 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| 00000110 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| 00000120 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| 00000130 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| 00000140 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| 00000150 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| 00000160 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| 00000170 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| 00000180 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| 00000190 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| 000001a0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| 000001b0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| 000001c0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| 000001d0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| 000001e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| 000001f0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| 00000200 **GPT Partition 1** $ sudo dd if=/dev/disk6 bs=512 count=1 skip=40 | hexdump -Cv 00000000 eb 58 90 42 53 44 20 20 34 2e 34 00 02 01 20 00 |.X.BSD 4.4... .| 00000010 02 00 00 00 00 f0 00 00 20 00 10 00 00 00 00 00 |........ .......| 00000020 00 40 06 00 4f 0c 00 00 00 00 00 00 02 00 00 00 |.@..O...........| 00000030 01 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| 00000040 00 00 29 ed 17 e3 67 45 46 49 20 20 20 20 20 20 |..)...gEFI | 00000050 20 20 46 41 54 33 32 20 20 20 fa 31 c0 8e d0 bc | FAT32 .1....| 00000060 00 7c fb 8e d8 e8 00 00 5e 83 c6 19 bb 07 00 fc |.|......^.......| 00000070 ac 84 c0 74 06 b4 0e cd 10 eb f5 30 e4 cd 16 cd |...t.......0....| 00000080 19 0d 0a 4e 6f 6e 2d 73 79 73 74 65 6d 20 64 69 |...Non-system di| 00000090 73 6b 0d 0a 50 72 65 73 73 20 61 6e 79 20 6b 65 |sk..Press any ke| 000000a0 79 20 74 6f 20 72 65 62 6f 6f 74 0d 0a 00 00 00 |y to reboot.....| 000000b0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| 000000c0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| 000000d0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| 000000e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| 000000f0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| 00000100 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| 00000110 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| 00000120 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| 00000130 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| 00000140 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| 00000150 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| 00000160 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| 00000170 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| 00000180 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| 00000190 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| 000001a0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| 000001b0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| 000001c0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| 000001d0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| 000001e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| 000001f0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 aa |..............U.| 00000200 **GPT Partition 2** $ sudo dd if=/dev/disk6 bs=512 count=1 skip=409640 | hexdump -Cv 00000000 65 f1 69 6d 45 1d 32 73 01 00 00 00 00 00 00 00 |e.imE.2s........| 00000010 a8 94 00 00 00 00 00 00 01 00 00 80 00 00 00 00 |................| 00000020 4e 58 53 42 00 10 00 00 f6 37 8f 0e 00 00 00 00 |NXSB.....7......| 00000030 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| 00000040 02 00 00 00 00 00 00 00 a6 87 6e b0 9d 7a 46 9f |..........n..zF.| 00000050 9f da 0f e9 af ae 73 d2 76 de 00 00 00 00 00 00 |......s.v.......| 00000060 a9 94 00 00 00 00 00 00 18 01 00 00 5c 6c 00 00 |............\l..| 00000070 01 00 00 00 00 00 00 00 19 01 00 00 00 00 00 00 |................| 00000080 0d 01 00 00 85 16 00 00 0b 01 00 00 02 00 00 00 |................| 00000090 79 16 00 00 0c 00 00 00 00 04 00 00 00 00 00 00 |y...............| 000000a0 f7 a5 11 00 00 00 00 00 01 04 00 00 00 00 00 00 |................| 000000b0 00 00 00 00 64 00 00 00 02 04 00 00 00 00 00 00 |....d...........| 000000c0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| 000000d0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| 000000e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| 000000f0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| 00000100 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| 00000110 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| 00000120 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| 00000130 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| 00000140 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| 00000150 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| 00000160 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| 00000170 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| 00000180 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| 00000190 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| 000001a0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| 000001b0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| 000001c0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| 000001d0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| 000001e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| 000001f0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| 00000200 **fsck_apfs output** $ sudo fsck_apfs -F -n /dev/disk6s2 ** Checking the container superblock. Checking the checkpoint with transaction ID 38056. ** Checking the space manager. warning: spaceman chunk 50 free count 1048041 > block count 32768 warning: spaceman chunk 76 free count 1047379 > block count 32768 warning: spaceman chunk 77 free count 1045263 > block count 32768 warning: spaceman chunk 81 free count 1047089 > block count 32768 warning: spaceman chunk 88 free count 1046859 > block count 32768 warning: spaceman chunk 95 free count 1048285 > block count 32768 warning: spaceman chunk 96 free count 1045846 > block count 32768 warning: spaceman chunk 106 free count 1038642 > block count 32768 warning: spaceman chunk 107 free count 1047917 > block count 32768 warning: spaceman chunk 108 free count 1048545 > block count 32768 warning: spaceman chunk 118 free count 1042009 > block count 32768 warning: spaceman chunk 120 free count 1047762 > block count 32768 warning: spaceman chunk 121 free count 1044764 > block count 32768 warning: spaceman chunk 159 free count 1043537 > block count 32768 warning: spaceman chunk 192 free count 1048119 > block count 32768 warning: spaceman chunk 197 free count 1047955 > block count 32768 warning: spaceman chunk 198 free count 1031491 > block count 32768 warning: spaceman chunk 214 free count 1020054 > block count 32768 warning: spaceman chunk 220 free count 1045881 > block count 32768 warning: spaceman chunk 234 free count 1046468 > block count 32768 warning: spaceman chunk 257 free count 1048280 > block count 32768 warning: spaceman chunk 270 free count 1045917 > block count 32768 warning: spaceman chunk 280 free count 1048521 > block count 32768 warning: spaceman chunk 288 free count 1047651 > block count 32768 warning: spaceman chunk 289 free count 1044620 > block count 32768 warning: spaceman chunk 294 free count 1046582 > block count 32768 warning: spaceman chunk 304 free count 1037560 > block count 32768 warning: spaceman chunk 305 free count 1047826 > block count 32768 warning: spaceman chunk 328 free count 1048515 > block count 32768 warning: spaceman chunk 330 free count 1045119 > block count 32768 warning: spaceman chunk 333 free count 1046817 > block count 32768 warning: spaceman chunk 334 free count 1047085 > block count 32768 warning: spaceman chunk 335 free count 1047577 > block count 32768 warning: spaceman chunk 336 free count 1037524 > block count 32768 warning: spaceman chunk 338 free count 1047719 > block count 32768 warning: spaceman chunk 342 free count 1047582 > block count 32768 warning: spaceman chunk 345 free count 1048065 > block count 32768 warning: spaceman chunk 348 free count 1046590 > block count 32768 warning: spaceman chunk 351 free count 1048000 > block count 32768 warning: spaceman chunk 354 free count 1048325 > block count 32768 warning: spaceman chunk 359 free count 1047571 > block count 32768 warning: spaceman chunk 360 free count 1048574 > block count 32768 warning: spaceman chunk 362 free count 1045869 > block count 32768 warning: spaceman chunk 364 free count 1023077 > block count 32768 warning: spaceman chunk 366 free count 1047638 > block count 32768 warning: spaceman chunk 368 free count 1047692 > block count 32768 warning: spaceman chunk 370 free count 1047439 > block count 32768 warning: spaceman chunk 373 free count 1048521 > block count 32768 warning: spaceman chunk 376 free count 1044611 > block count 32768 warning: spaceman chunk 379 free count 1039521 > block count 32768 Too many warnings of this type generated; suppressing subsequent ones. warning: (oid 0x6f84) cib: invalid o_cksum (0xffffffffffffffff) error: failed to read spaceman cib 27 at address 0x6f84 Space manager is invalid. ** The container /dev/disk6s2 could not be verified completely.

here is my situation : I've encrypted an external drive with a tool (M3 bitlocker on Mac) with a password. I wanted to remove the encryption but decryption was not part of the M3 bitlocker free trial, so I used Hasleo BitLocker Anywhere which is free. The decryption was in progress until the software freezes, so I had to kill it. Then I was unable to see my hard drive anymore. Here is what I did then : - I succeeded to clone my hard drive with DMDE in my Windows computer - I did run chkdsk on this clone and it fixed some partitions - I mounted it as a virtual drive - I can access all my folders and files without password - Some files are accessibles and some are not (ex: some videos cannot be played) - I tried a lot of tools without any success :/ I've contacted the Hasleo BitLocker Anywhere support and they told me that decrypting the data is not possible anymore since the decryption process was aborted. It should have stored some *.bad file in /Applications/HasloeBitLockerAnywhere.app/Contents/MacOS but I've reinstalled the software so there no files there. Do you have any ideas how could I decrypt all the files ? Thanks in advance,

I have a USB thumb drive that’s encrypted using Disk Utility standard encryption, so the drive requires a password to access the data/files. My question is, is there a log of each time the USB drive is accessed, mounted to a computer, or opened? If I plug it in, type in the password, and access the files, will I be able to see the last time the drive was accessed? (Logged into). Is the history log only available if the thumb drive is plugged into the same computer or is the history there for anyone with the password?

I'm doing day-to-day activities on a MacBook connected to a coffee shop wifi network, which is an 'Unsecured Network...': When clicked on: I'm only visiting http***s*** websites, but I know websites aren't the only way the apps/device are interacting over the unsecured network. So I wonder.. ### Question Is there a macOS feature, macOS app, or command line tool I can audit all network traffic over, say, an hour or a day, and let me filter on any that is unencrypted, so I can inspect it and determine if it's a risk.

As a way to gain access to a bitlocker encrypted usb drive, I decided to use Windows 11 via VM on my Mac OS 12.7.5. However, the encrypted USB file is not detected in VirtualBox, even after following these steps: https://forums.virtualbox.org/viewtopic.php?f=35&t=82639#p390401 . A non-encrypted usb drive could be read in VirtualBox, so I think the installation of the VirtualBox extension package worked. However, the sole purpose of this VM is to gain access to the bitlocker encrypted usb drive. Does anybody have any recommendations?

I saw on the Apple documents on their website ( Here: https://support.apple.com/en-us/HT210650 ) that Macintosh HD is read-only volume called maybe "startup disk" for system files and user data goes to Macintosh HD - Data, But I can't find that volume in my macbook or in Filevault there is no option coming to turn FileVault On For "Macintosh HD - Data", it only says there "Filevault is turned on for the disk Macintosh HD" does it mean that the user data is still unencrypted!, and it was On already by default, I didn't turned it On. But I want to encrypt the user data wherever it is by FileVault in order to securely erase it from the Macbook in future whenever needed. Please tell me how to do it or where to find that volume or explain to me if the user data is also on the "Macintosh HD" only but in the Disk Utility there is an another Volume called only "Data" other than the "Macintosh HD" I am confused why is it not showing in the FileVault that means it is not encrypted and it is where the user data is going? can this happen that it is already encrypted and I can stop worrying or what?