CAJ | 학술논문

苹果公司推出OS X 10.3（Panther）系统时，引入了FileVault磁盘加密功能。在最新发布的OS X Lion 系统中，引入了全新加密方式FileVault2。FileVault2使用全磁盘、AES-XTS 128加密来帮助保护数据安全。针对当前大部分的取证软件都不支持对经过FileVault2加密的磁盘进行数据解析问题，文章首先讨论了FileVault2的加密原理，接着提出了离线解密的方法，并在此基础上设计了FileVault2取证工具，使得加密磁盘摆脱了目标数据源对Mac OS系统的依赖，能够在没有Mac OS系统的环境下对经过FileVault2加密的磁盘进行取证。实践表明此离线解密方法丰富了加密数据的取证项。
평과공사추출OS X 10.3（Panther）계통시，인입료FileVault자반가밀공능。재최신발포적OS X Lion 계통중，인입료전신가밀방식FileVault2。FileVault2사용전자반、AES-XTS 128가밀래방조보호수거안전。침대당전대부분적취증연건도불지지대경과FileVault2가밀적자반진행수거해석문제，문장수선토론료FileVault2적가밀원리，접착제출료리선해밀적방법，병재차기출상설계료FileVault2취증공구，사득가밀자반파탈료목표수거원대Mac OS계통적의뢰，능구재몰유Mac OS계통적배경하대경과FileVault2가밀적자반진행취증。실천표명차리선해밀방법봉부료가밀수거적취증항。
Apple launched OS X 10.3 (Panther) system, the introduction of a FileVault disk encryption feature. In the latest release of OS X Lion system, the introduction of a new encryption FileVault2. FileVault2 uses full disk, AES-XTS 128 encryption to help keep data secure. Given that most of forensic soft can’t achieve forensics quickly on FileVault2 encrypting disk. This paper ifrst discusser encrypting principles of the FileVault2, then puts the FileVault2 decryption method oflfine. And on this basis, designs the decrypting FileVault2 tools, which works independent of the operating system on the target data source and able to in the absence of Mac OS system environment through FileVault2 encrypted disk forensics. Practice shows that offline decryption method enriches the evidence items.