{"id":14864,"date":"2019-09-24T00:00:00","date_gmt":"2019-09-24T00:00:00","guid":{"rendered":"https:\/\/adfsolutions.com\/boot-scan-mac-apfs-filevault-2\/"},"modified":"2026-03-11T14:20:31","modified_gmt":"2026-03-11T14:20:31","slug":"boot-scan-mac-apfs-filevault-2","status":"publish","type":"post","link":"https:\/\/adfsolutions.com\/boot-scan-mac-apfs-filevault-2\/","title":{"rendered":"How to Boot Scan a Mac with APFS and FileVault 2"},"content":{"rendered":"\n

In this short 4-minute Mac forensics<\/a> “How To” video, ADF forensic specialist, Rich Frawley, shows you how to conduct a boot scan of a MacBook Air with APFS & FileVault2 enabled.<\/p>\n\n

Beginning at this point you have decided on a Search Profile or the profiles to use and prepared your collection key Rich will demonstrate a forensically sound Mac boot scan using Digital Evidence Investigator<\/a>\u00ae<\/sup>. This means that no changes are made to the target media.<\/p>\n{% video_player “embed_player” overrideable=False, type=’scriptV4′, hide_playlist=True, viral_sharing=False, embed_button=False, autoplay=False, hidden_controls=False, loop=False, muted=False, full_width=False, width=’1920′, height=’1162′, player_id=’14450946594′, style=’margin: 10px auto;’, color=’fe8b3f’, play_button_color=’fe8b3f’ %}\n

Prior to conducting a Boot Scan establish how many USB ports are available and determine if the 4-port USB hub is required. Two ports are required in order to complete a scan, one for the Collection Key and one for the ADF Authentication Key. Once the scan has started the ADF Authentication Key can be removed.<\/p>\n

In this example, the MacBook Air has two USB ports so you will be ready to go with the collection key connected and the Authentication Key. In order to boot to the USB Device you will hold the Option key after pushing and releasing the power button.<\/p>\n

When booting to the Collection Key, Digital Evidence Investigator will automatically launch the application to scan the computer. No user input is normally required within the Windows Boot Manager. <\/p>\n

Once DEI has launched there are two options available:<\/p>\n

    \n
  1. Scan Computer<\/li>\n
  2. Image Computer<\/li>\n<\/ol>\n

    To proceed with the boot scan click on Scan Computer and select the target device(s). <\/p>\n

    Physical Drives are denoted by a hard disk icon. Logical volumes are listed beneath the physical drive entry.  Attached devices are denoted by a flash drive icon. Bitlocker\/FileVault 2 volumes are flagged (volume will be disabled if not decrypted). Credentials can be added to make the volume available. <\/p>\n

    Add the password or recovery key to unlock the drive.<\/p>\n

    Once a scan is complete you are given the option to Image the device or I can go directly to image device.<\/p>\n

    Watch: Boot Scan a Mac with APFS (Non-Encrypted)<\/span><\/a><\/p>\n

    Learn about Mac – M1 T2 Recovery Mode Scan capabilities.<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

    In this short 4-minute Mac forensics “How To” video, ADF forensic specialist, Rich Frawley, shows you how to conduct a boot scan of a MacBook Air with APFS & FileVault2 enabled.<\/p>\n","protected":false},"author":3,"featured_media":13243,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"content-type":"","footnotes":""},"categories":[63,283],"tags":[159,146,96,73,36,74,99],"class_list":["post-14864","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news","category-video","tag-apfs","tag-apple-mac-forensics","tag-computer-forensics-video","tag-dei-pro","tag-digital-evidence","tag-digital-evidence-investigator","tag-how-to-video","optech-blog blog-single"],"yoast_head":"\nHow to Boot Scan a Mac with APFS and FileVault 2 - ADF Solutions<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/adfsolutions.com\/boot-scan-mac-apfs-filevault-2\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"How to Boot Scan a Mac with APFS and FileVault 2 - ADF Solutions\" \/>\n<meta property=\"og:description\" content=\"In this short 4-minute Mac forensics “How To” video, ADF forensic specialist, Rich Frawley, shows you how to conduct a boot scan of a MacBook Air with APFS & FileVault2 enabled.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/adfsolutions.com\/boot-scan-mac-apfs-filevault-2\/\" \/>\n<meta property=\"og:site_name\" content=\"ADF Solutions\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/adfsolutions\" \/>\n<meta property=\"article:published_time\" content=\"2019-09-24T00:00:00+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2026-03-11T14:20:31+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/adfsolutions.com\/wp-content\/uploads\/2026\/01\/Boot-Scan-a-Mac-APFS-FileVault-2-1.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"1200\" \/>\n\t<meta property=\"og:image:height\" content=\"675\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Richard T. Frawley\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@adfsolutions\" \/>\n<meta name=\"twitter:site\" content=\"@adfsolutions\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Richard T. Frawley\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"2 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/adfsolutions.com\/boot-scan-mac-apfs-filevault-2\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/adfsolutions.com\/boot-scan-mac-apfs-filevault-2\/\"},\"author\":{\"name\":\"Richard T. Frawley\",\"@id\":\"https:\/\/adfsolutions.com\/#\/schema\/person\/f7fc6bb598702f2c7fd213ae40c2ac39\"},\"headline\":\"How to Boot Scan a Mac with APFS and FileVault 2\",\"datePublished\":\"2019-09-24T00:00:00+00:00\",\"dateModified\":\"2026-03-11T14:20:31+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/adfsolutions.com\/boot-scan-mac-apfs-filevault-2\/\"},\"wordCount\":397,\"publisher\":{\"@id\":\"https:\/\/adfsolutions.com\/#organization\"},\"image\":{\"@id\":\"https:\/\/adfsolutions.com\/boot-scan-mac-apfs-filevault-2\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/adfsolutions.com\/wp-content\/uploads\/2026\/01\/Boot-Scan-a-Mac-APFS-FileVault-2-1.jpg\",\"keywords\":[\"APFS\",\"Apple Mac Forensics\",\"Computer Forensics Video\",\"DEI PRO\",\"Digital Evidence\",\"Digital Evidence Investigator\",\"How To Video\"],\"articleSection\":[\"News\",\"Video\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/adfsolutions.com\/boot-scan-mac-apfs-filevault-2\/\",\"url\":\"https:\/\/adfsolutions.com\/boot-scan-mac-apfs-filevault-2\/\",\"name\":\"How to Boot Scan a Mac with APFS and FileVault 2 - ADF Solutions\",\"isPartOf\":{\"@id\":\"https:\/\/adfsolutions.com\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/adfsolutions.com\/boot-scan-mac-apfs-filevault-2\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/adfsolutions.com\/boot-scan-mac-apfs-filevault-2\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/adfsolutions.com\/wp-content\/uploads\/2026\/01\/Boot-Scan-a-Mac-APFS-FileVault-2-1.jpg\",\"datePublished\":\"2019-09-24T00:00:00+00:00\",\"dateModified\":\"2026-03-11T14:20:31+00:00\",\"breadcrumb\":{\"@id\":\"https:\/\/adfsolutions.com\/boot-scan-mac-apfs-filevault-2\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/adfsolutions.com\/boot-scan-mac-apfs-filevault-2\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/adfsolutions.com\/boot-scan-mac-apfs-filevault-2\/#primaryimage\",\"url\":\"https:\/\/adfsolutions.com\/wp-content\/uploads\/2026\/01\/Boot-Scan-a-Mac-APFS-FileVault-2-1.jpg\",\"contentUrl\":\"https:\/\/adfsolutions.com\/wp-content\/uploads\/2026\/01\/Boot-Scan-a-Mac-APFS-FileVault-2-1.jpg\",\"width\":1200,\"height\":675},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/adfsolutions.com\/boot-scan-mac-apfs-filevault-2\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/adfsolutions.com\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"How to Boot Scan a Mac with APFS and FileVault 2\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/adfsolutions.com\/#website\",\"url\":\"https:\/\/adfsolutions.com\/\",\"name\":\"ADF Solutions\",\"description\":\"\",\"publisher\":{\"@id\":\"https:\/\/adfsolutions.com\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/adfsolutions.com\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/adfsolutions.com\/#organization\",\"name\":\"ADF Solutions\",\"url\":\"https:\/\/adfsolutions.com\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/adfsolutions.com\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/adfsolutions.com\/wp-content\/uploads\/2026\/01\/favicon.png\",\"contentUrl\":\"https:\/\/adfsolutions.com\/wp-content\/uploads\/2026\/01\/favicon.png\",\"width\":512,\"height\":512,\"caption\":\"ADF Solutions\"},\"image\":{\"@id\":\"https:\/\/adfsolutions.com\/#\/schema\/logo\/image\/\"},\"sameAs\":[\"https:\/\/www.facebook.com\/adfsolutions\",\"https:\/\/x.com\/adfsolutions\",\"https:\/\/www.linkedin.com\/company\/adf-solutions\/\"]},{\"@type\":\"Person\",\"@id\":\"https:\/\/adfsolutions.com\/#\/schema\/person\/f7fc6bb598702f2c7fd213ae40c2ac39\",\"name\":\"Richard T. Frawley\",\"url\":\"https:\/\/adfsolutions.com\/author\/richardtfrawley\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"How to Boot Scan a Mac with APFS and FileVault 2 - ADF Solutions","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/adfsolutions.com\/boot-scan-mac-apfs-filevault-2\/","og_locale":"en_US","og_type":"article","og_title":"How to Boot Scan a Mac with APFS and FileVault 2 - ADF Solutions","og_description":"In this short 4-minute Mac forensics “How To” video, ADF forensic specialist, Rich Frawley, shows you how to conduct a boot scan of a MacBook Air with APFS & FileVault2 enabled.","og_url":"https:\/\/adfsolutions.com\/boot-scan-mac-apfs-filevault-2\/","og_site_name":"ADF Solutions","article_publisher":"https:\/\/www.facebook.com\/adfsolutions","article_published_time":"2019-09-24T00:00:00+00:00","article_modified_time":"2026-03-11T14:20:31+00:00","og_image":[{"width":1200,"height":675,"url":"https:\/\/adfsolutions.com\/wp-content\/uploads\/2026\/01\/Boot-Scan-a-Mac-APFS-FileVault-2-1.jpg","type":"image\/jpeg"}],"author":"Richard T. Frawley","twitter_card":"summary_large_image","twitter_creator":"@adfsolutions","twitter_site":"@adfsolutions","twitter_misc":{"Written by":"Richard T. Frawley","Est. reading time":"2 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/adfsolutions.com\/boot-scan-mac-apfs-filevault-2\/#article","isPartOf":{"@id":"https:\/\/adfsolutions.com\/boot-scan-mac-apfs-filevault-2\/"},"author":{"name":"Richard T. Frawley","@id":"https:\/\/adfsolutions.com\/#\/schema\/person\/f7fc6bb598702f2c7fd213ae40c2ac39"},"headline":"How to Boot Scan a Mac with APFS and FileVault 2","datePublished":"2019-09-24T00:00:00+00:00","dateModified":"2026-03-11T14:20:31+00:00","mainEntityOfPage":{"@id":"https:\/\/adfsolutions.com\/boot-scan-mac-apfs-filevault-2\/"},"wordCount":397,"publisher":{"@id":"https:\/\/adfsolutions.com\/#organization"},"image":{"@id":"https:\/\/adfsolutions.com\/boot-scan-mac-apfs-filevault-2\/#primaryimage"},"thumbnailUrl":"https:\/\/adfsolutions.com\/wp-content\/uploads\/2026\/01\/Boot-Scan-a-Mac-APFS-FileVault-2-1.jpg","keywords":["APFS","Apple Mac Forensics","Computer Forensics Video","DEI PRO","Digital Evidence","Digital Evidence Investigator","How To Video"],"articleSection":["News","Video"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/adfsolutions.com\/boot-scan-mac-apfs-filevault-2\/","url":"https:\/\/adfsolutions.com\/boot-scan-mac-apfs-filevault-2\/","name":"How to Boot Scan a Mac with APFS and FileVault 2 - ADF Solutions","isPartOf":{"@id":"https:\/\/adfsolutions.com\/#website"},"primaryImageOfPage":{"@id":"https:\/\/adfsolutions.com\/boot-scan-mac-apfs-filevault-2\/#primaryimage"},"image":{"@id":"https:\/\/adfsolutions.com\/boot-scan-mac-apfs-filevault-2\/#primaryimage"},"thumbnailUrl":"https:\/\/adfsolutions.com\/wp-content\/uploads\/2026\/01\/Boot-Scan-a-Mac-APFS-FileVault-2-1.jpg","datePublished":"2019-09-24T00:00:00+00:00","dateModified":"2026-03-11T14:20:31+00:00","breadcrumb":{"@id":"https:\/\/adfsolutions.com\/boot-scan-mac-apfs-filevault-2\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/adfsolutions.com\/boot-scan-mac-apfs-filevault-2\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/adfsolutions.com\/boot-scan-mac-apfs-filevault-2\/#primaryimage","url":"https:\/\/adfsolutions.com\/wp-content\/uploads\/2026\/01\/Boot-Scan-a-Mac-APFS-FileVault-2-1.jpg","contentUrl":"https:\/\/adfsolutions.com\/wp-content\/uploads\/2026\/01\/Boot-Scan-a-Mac-APFS-FileVault-2-1.jpg","width":1200,"height":675},{"@type":"BreadcrumbList","@id":"https:\/\/adfsolutions.com\/boot-scan-mac-apfs-filevault-2\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/adfsolutions.com\/"},{"@type":"ListItem","position":2,"name":"How to Boot Scan a Mac with APFS and FileVault 2"}]},{"@type":"WebSite","@id":"https:\/\/adfsolutions.com\/#website","url":"https:\/\/adfsolutions.com\/","name":"ADF Solutions","description":"","publisher":{"@id":"https:\/\/adfsolutions.com\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/adfsolutions.com\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/adfsolutions.com\/#organization","name":"ADF Solutions","url":"https:\/\/adfsolutions.com\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/adfsolutions.com\/#\/schema\/logo\/image\/","url":"https:\/\/adfsolutions.com\/wp-content\/uploads\/2026\/01\/favicon.png","contentUrl":"https:\/\/adfsolutions.com\/wp-content\/uploads\/2026\/01\/favicon.png","width":512,"height":512,"caption":"ADF Solutions"},"image":{"@id":"https:\/\/adfsolutions.com\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/adfsolutions","https:\/\/x.com\/adfsolutions","https:\/\/www.linkedin.com\/company\/adf-solutions\/"]},{"@type":"Person","@id":"https:\/\/adfsolutions.com\/#\/schema\/person\/f7fc6bb598702f2c7fd213ae40c2ac39","name":"Richard T. Frawley","url":"https:\/\/adfsolutions.com\/author\/richardtfrawley\/"}]}},"_links":{"self":[{"href":"https:\/\/adfsolutions.com\/wp-json\/wp\/v2\/posts\/14864","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/adfsolutions.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/adfsolutions.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/adfsolutions.com\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/adfsolutions.com\/wp-json\/wp\/v2\/comments?post=14864"}],"version-history":[{"count":2,"href":"https:\/\/adfsolutions.com\/wp-json\/wp\/v2\/posts\/14864\/revisions"}],"predecessor-version":[{"id":16730,"href":"https:\/\/adfsolutions.com\/wp-json\/wp\/v2\/posts\/14864\/revisions\/16730"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/adfsolutions.com\/wp-json\/wp\/v2\/media\/13243"}],"wp:attachment":[{"href":"https:\/\/adfsolutions.com\/wp-json\/wp\/v2\/media?parent=14864"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/adfsolutions.com\/wp-json\/wp\/v2\/categories?post=14864"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/adfsolutions.com\/wp-json\/wp\/v2\/tags?post=14864"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}