Crate filevault 

filevault — Apple CoreStorage / FileVault 2 (FVDE) reader & decryptor

A panic-free, bounds-checked decryptor for CoreStorage / FileVault 2 volumes (macOS 10.7–10.15, AES-XTS-128, password protector). Parses the physical volume header, decrypts the CoreStorage metadata, derives the volume key hierarchy from a password (PBKDF2-HMAC-SHA256 → RFC 3394 AES-KW → SHA-256 tweak key, all RustCrypto — never hand-rolled), and exposes the plaintext logical volume as a Read + Seek stream.

APFS-native encryption (10.13+) is a separate format and is out of scope.

use std::fs::File;
use filevault::FileVaultVolume;

let image = File::open("cs_partition.raw")?;
let mut volume = FileVaultVolume::unlock_with_password(image, "fvde-TEST")?;
let mut sector = [0u8; 512];
volume.read_at(0, &mut sector)?;

Re-exports

pub use context::EncryptionContext;

pub use context::LogicalVolumeInfo;

pub use context::Protector;

pub use context::ProtectorKind;

pub use error::FileVaultError;

pub use volume::DecryptedVolume;

pub use volume_header::VolumeHeader;

Modules

context

Targeted extraction from the decrypted CoreStorage metadata.

error

Error type for the FileVault / CoreStorage decryptor.

metadata

Locate and decrypt the CoreStorage encrypted-metadata region.

read

Bounds-checked integer/byte readers over attacker-controllable image data.

unlock

The CoreStorage / FileVault key hierarchy (RustCrypto — never hand-rolled).

volume

Decrypted logical-volume reader: AES-XTS-128 over 512-byte sectors, tweak = logical sector number, single contiguous segment at the LV physical base.

volume_header

The 512-byte CoreStorage physical volume header (partition start, LE fields).

xts

AES-XTS-128 decryption over the xts-mode crate (never hand-rolled).

Structs

FileVaultInfo

Password-independent metadata parsed from a CoreStorage volume.

FileVaultVolume

An unlocked CoreStorage / FileVault volume presenting the decrypted logical volume as a Read + Seek stream.

Functions

parse_info

Parse only the password-independent metadata from a reader, WITHOUT the password — the entry point filevault-forensic uses to audit a locked volume.