Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

> (the OS volume itself isn't encrypted and is read-only, the data volume is encrypted with your password)

Wait, WHAT? Can someone with an M1 encrypted volume Mac check this directory and see if you see thumbnails?

> $TMPDIR/../C/com.apple.QuickLook.thumbnailcache/

A full writeup of this is at the link [1]. This has been a well-known thing in computer forensics for many years, which is why *full* disk encryption is so important.

[1]: https://objective-see.com/blog/blog_0x30.html



Everything in the Data volume is encrypted. The System volume is signed by Apple and is the same on every Big Sur Mac (SSV feature).

This can be disabled through csrutil though.


The OS volume is a read-only image now - just system files only, and is signed etc


No such file or directory on my M1 Air.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: