Best way to decrypt a file vault encrypted USB drive and image the data
Hi all,
I’m working on a case with a USB drive that appears to be encrypted with FileVault. The drive was already imaged and we allegedly have the password, but I’m looking for a way to decrypt/image the FileVault partition without altering the data.
I’m hoping someone can point me in the right direction. Does this drive need to be connected to a Mac computer to enter the password, or is there other software that can perhaps mount the image on a Windows machine? Maybe Mount Imager Professional?
If the drive has to be connected to a Mac computer, what’s the best way to image just that partition? (There were other partitions on the drive that were not encrypted.)
Years ago, there was FTK Imager for Mac - I’m not sure if that is still around and supported.
Any insight is appreciated. Thanks in advance.