{"id":1945,"date":"2018-11-02T11:07:15","date_gmt":"2018-11-02T03:07:15","guid":{"rendered":"http:\/\/blog.md5.red\/?p=1945"},"modified":"2018-11-16T16:30:32","modified_gmt":"2018-11-16T08:30:32","slug":"macbook-%e7%9b%ae%e6%a0%87%e7%a3%81%e7%9b%98%e6%a8%a1%e5%bc%8f%e6%8b%b7%e8%b4%9d","status":"publish","type":"post","link":"http:\/\/blog.md5.red\/?p=1945","title":{"rendered":"Macbook OSX 10.13,10.14 \u53d6\u8bc1"},"content":{"rendered":"<p><a href=\"http:\/\/blog.md5.red\/wp-content\/uploads\/2018\/11\/macos-sierra-system-startup-select.png\" class=\"highslide-image\" onclick=\"return hs.expand(this);\"><img decoding=\"async\" class=\"alignnone wp-image-1966\" src=\"http:\/\/blog.md5.red\/wp-content\/uploads\/2018\/11\/macos-sierra-system-startup-select-1024x618.png\" alt=\"\" width=\"671\" height=\"405\" srcset=\"http:\/\/blog.md5.red\/wp-content\/uploads\/2018\/11\/macos-sierra-system-startup-select-1024x618.png 1024w, http:\/\/blog.md5.red\/wp-content\/uploads\/2018\/11\/macos-sierra-system-startup-select-300x181.png 300w, http:\/\/blog.md5.red\/wp-content\/uploads\/2018\/11\/macos-sierra-system-startup-select-768x463.png 768w, http:\/\/blog.md5.red\/wp-content\/uploads\/2018\/11\/macos-sierra-system-startup-select.png 1336w\" sizes=\"(max-width: 671px) 100vw, 671px\" \/><\/a><\/p>\n<p>T2\u82af\u7247\uff0c\u4e0d\u884c<\/p>\n<p>10.14\u62f7\u8d1d\u5206\u533a\uff0c\u5168\u76d8\u4e0d\u884c<\/p>\n<p>&nbsp;<\/p>\n<p>APFS\uff0c4K<\/p>\n<p>Recovery\u6a21\u5f0f<\/p>\n<p>\u6216T\u6a21\u5f0f\u8fde\u63a5\u540e\uff0c\u5173\u95ed\u672c\u673asip\uff0ccsrutil disable<\/p>\n<p>diskutil list \u67e5\u770b\u78c1\u76d8\u4fe1\u606f<\/p>\n<p>.\/dc3dd if=\/dev\/rdisk1s3 of=recovery.001 bufsz=48M\u00a0 \u5199\u5230\u56fa\u6001\u786c\u76d8<\/p>\n<p>ftk imager\u8f6c\u6362\u6210e01\uff0c\u5b58\u5230NTFS\u5206\u533a\uff0c\u8bbe\u7f6e\u5355\u4e2a\u6587\u4ef6\u6700\u59272T\uff0c\u538b\u7f29\u9ed8\u8ba46\uff0c\u7136\u540e\u7528blackbag\u7684ewmounter\u6302\u8f7d<\/p>\n<p>&nbsp;<\/p>\n<p>\u7528blackbag\u7684<a href=\"https:\/\/www.blackbagtech.com\/resources\/freetools\/dmg-rename.html\">DMG Rename<\/a>\u5de5\u5177\u8f6c\u6362\u6210DMG\u683c\u5f0f<\/p>\n<p>hdiutil attach &lt;\/PATH\/TO\/.dmg&gt; -blocksize 4096 -readonly \u88c5\u8f7d\u5e76\u6302\u8f7d<\/p>\n<p>hdiutil attach &lt;\/PATH\/TO\/.dmg&gt; -blocksize 4096 -readonly -nomount \u88c5\u8f7d\u4f46\u4e0d\u6302\u8f7d\uff0c\u6709\u52a0\u5bc6\u7684\u65f6\u5019<\/p>\n<p>hdiutil attach -nomount -shadow &lt;PATH\/TO\/SHADOW_FILE&gt; &lt;PATH\/TO\/.dmg&gt; -noautofsck \u5982\u679c\u5b58\u5728\u810f\u6570\u636e\uff0c\u6302\u4e0d\u4e0a\uff0c\u53ef\u4ee5\u5c1d\u8bd5\u8fd9\u4e2a\u547d\u4ee4<\/p>\n<p>&nbsp;<\/p>\n<p>\u6709filevault\u52a0\u5bc6\u7684\u65f6\u5019\uff0c\u4e5f\u53ef\u4ee5\u7528\u4e0b\u9762\u7684\u547d\u4ee4\uff1a<\/p>\n<p>hdiutil attach \u2013nomount \u2013blocksize 4096 \/Volumes\/4k_image\/4k.dmg\u00a0 \u88c5\u8f7d\u4f46\u4e0d\u6302\u8f7d<\/p>\n<p>diskutil apfs unlockVolume \/dev\/disk5s1 -nomount \u89e3\u9501<\/p>\n<p>diskutil apfs list<\/p>\n<p>sudo mount_apfs \u2013o rdonly,noexec,noowners \/dev\/disk# \/Volumes\/apfs_mounted\/ \u6302\u8f7d\u5230\u8def\u5f84\uff0c\u53ef\u4ee5\u6302\u8f7dRecovery\u5206\u533a<\/p>\n<p>\uff08wipekey\u8def\u5f84\uff1aRecovery\/com.apple.boot.P\/System\/Library\/Caches\/com.apple.corestorage\/EncryptedRoot.plist.wipekey\uff09<\/p>\n<p>hdiutil detach \/dev\/disk3 \u5378\u8f7d\u5bb9\u5668<\/p>\n<p>hdiutil detach \/dev\/disk4 \u5378\u8f7d\u78c1\u76d8<\/p>\n<p>&nbsp;<\/p>\n<p>\u53c2\u8003\uff1a<\/p>\n<p>https:\/\/www.blackbagtech.com\/blog\/2018\/04\/11\/apple-file-system-apfs-mac-forensic-imaging-analysis\/<\/p>\n<p>https:\/\/www.mac4n6.com\/blog\/2017\/11\/26\/mount-all-the-things-mounting-apfs-and-4k-disk-images-on-macos-1013<\/p>\n","protected":false},"excerpt":{"rendered":"<p>T2\u82af\u7247\uff0c\u4e0d\u884c 10.14\u62f7\u8d1d\u5206\u533a\uff0c\u5168\u76d8\u4e0d\u884c &nbsp; APFS\uff0c4K Recovery\u6a21\u5f0f \u6216T\u6a21\u5f0f\u8fde\u63a5 ...<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-1945","post","type-post","status-publish","format-standard","hentry","category-1"],"_links":{"self":[{"href":"http:\/\/blog.md5.red\/index.php?rest_route=\/wp\/v2\/posts\/1945","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/blog.md5.red\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/blog.md5.red\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/blog.md5.red\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/blog.md5.red\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1945"}],"version-history":[{"count":21,"href":"http:\/\/blog.md5.red\/index.php?rest_route=\/wp\/v2\/posts\/1945\/revisions"}],"predecessor-version":[{"id":2003,"href":"http:\/\/blog.md5.red\/index.php?rest_route=\/wp\/v2\/posts\/1945\/revisions\/2003"}],"wp:attachment":[{"href":"http:\/\/blog.md5.red\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1945"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/blog.md5.red\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1945"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/blog.md5.red\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1945"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}