Re: [sleuthkit-users] More Questions - Way to Detect if Filevault is in Use?
Brought to you by:
carrier
From: Alex N. <ajn...@cs...> - 2011-10-18 21:17:21
|
The big indicator I'd expect would be looking under /Users and seeing a <username>.sparsebundle directory in anybody's home. --Alex On Oct 18, 2011, at 13:58 , Karl Bernard wrote: > Another question regarding my current investigation... > > Does anyone know of filesystem-level markers or files that would show if Mac filevault is in use on an HFS+ volume? > > I swear I've been Googling, but haven't been able to find anything useful... > > Thanks for any suggestions, > > Karl Bernard > ------------------------------------------------------------------------------ > All the data continuously generated in your IT infrastructure contains a > definitive record of customers, application performance, security > threats, fraudulent activity and more. Splunk takes this data and makes > sense of it. Business sense. IT sense. Common sense. > http://p.sf.net/sfu/splunk-d2d-oct_______________________________________________ > sleuthkit-users mailing list > https://lists.sourceforge.net/lists/listinfo/sleuthkit-users > http://www.sleuthkit.org |