volatility-filevault2: extract Apple FileVault 2 Volume Master Keys
volatility-filevault2 This is a volatility plugin which attempts to extract Apple FileVault 2 Volume Master Keys. How it works Filevault appears to keep the volume master key in a consistently identifiable region of read-only...
