File Vault

From ForensicsWiki
Revision as of 04:17, 11 June 2007 by Slg (Talk | contribs)

Jump to: navigation, search

File Vault is the cryptographic file system developed by Apple and introduced with MacOS 10.3.

File Vault works by storing each user's home directory in an encrypted ".sparseimage" file. The file is automatically mounted when the user logs in and unmounted when the user logs out. All of the user's files and preferences are stored in this file. The file's encryption key is stored in the .sparseimage file, but that encryption key is itself encrypted with the user's login password.

There are no known attacks against File Vault other than a brute force attack on the user's password.

You can find a good discussion of File Vault's usability shortcomings in Simson Garfinkel's PhD Thesis.