# Mac  investigation - Drive encrypted

**URL:** <https://sleuthkit.discourse.group/t/mac-investigation-drive-encrypted/2095>\
**Category:** Autopsy Help\
**Created:** [August 17, 2020, 10:43am UTC](https://sleuthkit.discourse.group/t/mac-investigation-drive-encrypted/2095 "2020-08-17T10:43:35Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Gh05t](https://avatars.discourse-cdn.com/v4/letter/g/51bf81/32.png) [@Gh05t](https://sleuthkit.discourse.group/u/Gh05t)\
**Post date:** [August 17, 2020, 10:43am UTC](https://sleuthkit.discourse.group/t/mac-investigation-drive-encrypted/2095/1 "2020-08-17T10:43:35Z")

</div>

Good day

I have a .eo1 file of an forensic investigation

In EnCase and FTK you need to put in the password to decrypt the image (drive) before you could start indexing and do investigation

Where and how do I decrypt the image (drive) with it’s password before doing the Ingest for the case and investigation

 ![Capture](https://global.discourse-cdn.com/free1/uploads/sleuthkit/original/2X/a/abc9cab8c5d45b381e28ebf8c243e47c25afa6e8.jpeg)

Thank You

---

<div class="post-metadata">

**Author:** ![Lotek\_Systems](https://yyz2.discourse-cdn.com/free1/user_avatar/sleuthkit.discourse.group/lotek_systems/32/1407_2.png) [@Lotek\_Systems](https://sleuthkit.discourse.group/u/Lotek_Systems)\
**Post date:** [July 3, 2021, 3:36am UTC](https://sleuthkit.discourse.group/t/mac-investigation-drive-encrypted/2095/2 "2021-07-03T03:36:04Z")

</div>

I have the same question.