Images: How to bypass FileVault, BitLocker security
Step 5: Extract RAM contents
Applebaum's next step is to run a program called "efidump" on his laptop that's linked to the MacBook with Ethernet. (Yes, that is a
EFI is the
After telling the efidump program the MacBook's Internet Protocol address, the utility extracted the complete contents of the Mac's RAM to a local file via the Ethernet cable. Applebaum named the 1.25 GB local file "/tmp/declan-macbook".













