Step 2: Make the link
Appelbaum now has the FileVault-protected laptop with the locking screensaver turned on and has begun trying to extract the AES encryption key.
FileVault is supposed to protect users against exactly this kind of attack--against, say, a thief who snatches your laptop locked via the screensaver from your home or office while you're away, or a laptop in sleep mode that's expropriated from its case at the airport. Apple promises just that: "The data in your home folder is encoded and your information is secure if your computer is lost or stolen."
What Appelbaum did first, as you can see in this photograph, was run an Ethernet cable from the MacBook to his own laptop. It's equipped with the memory forensics tools that he and the other researchers developed. The other researchers are J. Alex Halderman, Seth Schoen, Nadia Heninger, William Clarkson, William Paul, Joseph Calandrino, Ariel J. Feldman, and Ed Felten, many of whom are affiliated with Princeton University.
Photo by Declan McCullagh/CNET News.com
