In essence, that's precisely what he's doing. The exact on-disk metadata layout may not be documented anywhere, so he pieced it together using the structure def

In essence, that's precisely what he's doing. The exact on-disk metadata layout may not be documented anywhere, so he pieced it together using the structure definitions in the source code. For those reading along at home, what is being done here is a run-of-the-mill bruteforce, this article could be about any FDE implementation. So now the real question .. what was the password? :-)