My mac was recently upgraded to OS X Yosemite and FileVault2 full disk encryption was turned on. Encryption finished, but things went horribly wrong and key parts of the disk are filled with all 0s (it's a 512GB SSD).
By reading Infiltrate the Vault: Security Analysis and Decryption of Lion Full Disk Encryption I was able to find the EncryptedRoot.plist.wipekey file. This is an Xml document that's encrypted using AES-XTS with a 128-bit key and all 0s for the tweak key. The entire file is treated as a single block.
On my machine's disk, the entire cipher text is 1888 512 byte blocks. In the middle of the file, 256 blocks (128K) are all set to 0.
Using libfvde, I'm able to decrypt up until the bad blocks, but no further.
Is there any way to alter the cipher text, or alter the AES-XTS decryption to recover the portion of the file after the bad blocks? From what I can tell - block cipher - the rest of the file is gone forever unless I can find my missing 128K.
I can post the cipher text (it's 970K total with 128K of 0s) and the decryption key if it would help evaluate whether more information can be extracted.
