Difference between revisions of "File Vault"

From ForensicsWiki
Jump to: navigation, search
m (New page: File Vault is the cryptographic file system developed by Apple and introduced with MacOS 10.3. File Vault works by storing each user's home directory in an encrypted ".sparseimage" file. ...)
 
 
(9 intermediate revisions by 6 users not shown)
Line 1: Line 1:
File Vault is the cryptographic file system developed by Apple and introduced with MacOS 10.3.
+
FileVault (or File Vault) is the cryptographic file system developed by [http://www.apple.com Apple] and introduced with MacOS 10.3.
  
File Vault works by storing each user's home directory in an encrypted ".sparseimage" file. The file is automatically mounted when the user logs in and unmounted when the user logs out. All of the user's files and preferences are stored in this file.  The file's encryption key is stored in the .sparseimage file, but that encryption key is itself encrypted with the user's login password.  
+
FileVault works by storing each user's home directory in an encrypted "[[.sparseimage]]" file. The file is automatically mounted when the user logs in and unmounted when the user logs out. All of the user's files and preferences are stored in this file.  The file's encryption key is stored in the .sparseimage file, but that encryption key is itself encrypted with the user's login password.  
  
 
There are no known attacks against File Vault other than a brute force attack on the user's password.
 
There are no known attacks against File Vault other than a brute force attack on the user's password.
 +
 +
As part of the [http://www.apple.com/macosx/features/300.html#security security enhancements] in OS X 10.5 (Leopard) Apple have moved from AES-128 to AES-256 for the encryption used in the disk image.
 +
 +
In Mac OS X 10.7 (Lion) a full volume encryption variant was introduced.
 +
 +
== See Also ==
 +
* [[FileVault Disk Encryption]]
 +
 +
== External Links ==
 +
* [http://www.simson.net/thesis Design Principles and Patterns for Computer Systems That Are Simultaneously Secure and Usable], by [[Simson Garfinkel]], May 2005. PhD thesis that discusses of File Vault's usability shortcomings.
 +
* [http://events.ccc.de/congress/2006/Fahrplan/track/Hacking/1642.en.html Unlocking FileVault] talk at 23rd Chaos Communication Congress (23c3), by [[Jacob Appelbaum]], [[Ralf-Philipp Weinmann]], December 2006
 +
** [http://events.ccc.de/congress/2006-static/static/2/3/r/23rd_Chaos_Communication_Congress_7c1f.html video]
 +
** [http://events.ccc.de/congress/2006-static/static/2/3/r/23rd_Chaos_Communication_Congress_7c1f.html audio]
 +
** [http://events.ccc.de/congress/2006/Fahrplan/attachments/1244-23C3VileFault.pdf slides]
 +
 +
== Tools ==
 +
* [https://code.google.com/p/vilefault VileFault]
 +
 +
[[Category:Encryption]]
 +
[[Category:Disk encryption]]

Latest revision as of 00:40, 8 August 2012

FileVault (or File Vault) is the cryptographic file system developed by Apple and introduced with MacOS 10.3.

FileVault works by storing each user's home directory in an encrypted ".sparseimage" file. The file is automatically mounted when the user logs in and unmounted when the user logs out. All of the user's files and preferences are stored in this file. The file's encryption key is stored in the .sparseimage file, but that encryption key is itself encrypted with the user's login password.

There are no known attacks against File Vault other than a brute force attack on the user's password.

As part of the security enhancements in OS X 10.5 (Leopard) Apple have moved from AES-128 to AES-256 for the encryption used in the disk image.

In Mac OS X 10.7 (Lion) a full volume encryption variant was introduced.

See Also

External Links

Tools