Objective The purpose of this walkthrough is to demonstrate how to successfully decrypt and gain access to a FileVault® 2 protected volume when the recovery key or passphrase is known in order to capture a forensic image for analysis. Tools Used EnCase® v6.18 MacQuisition™ FTK® Imager Mac OS® Terminal Note: MacQuisition 2013 R2 now supports auto-detection of FV2 protected volumes…