FileVault

File Vault is the MacOS X 10.4 and 10.5 technology that encrypts a user's Home folder with 128 bit AES encryption, on the fly, such that it is nearly impossible to see the contents once a machine has been shut down. Because of this, it is very important that you consider what to do with a running Macintosh when you are the first responder. If you "yank" the plug and head out with your properly seized computer, you may have seized a bunch of digital garbage if you can't figure out a way to break the password. This page is not going to try and teach you decryption methods. (That is the job of Spartan in the Files section)

When you approach a running Macintosh, consider copying the contents of the user's Home folder if FileVault is enabled. It is easy to tell if it is enabled by the Home icon being used in the Finder window. If the "House" shows a combination lock on it, you have File Vault enabled.

Also, you may have other users on the system currently logged in that have File Vault in use.

In Leopard, a user's home directory is encrypted to a special series of files called a "sparsebundle". In Tiger, a user's home directory is encrypted to a flat file called a "sparseimage". If you are extremely interested in learning more about these files, start by reading the "man" page for "hdiutil". It actually gives a good, although short, description of what a sparsebundle is. Next, you need to visit the Apple Developer website where the technical discussion will jump up quickly.

Added to the Files section is an application to try a dictionary attack against a FileVault "sparebundle" or "sparseimage". The application, Spartan, will ask for a dictionary file and then ask for a Filevault image file. Have fun, and have patience! A dictionary attack on an encrypted file takes a very long time!

Read more about FileVault and Time Machine here.