a.In the /private/var/vm folder, sits the sleep image and swap files.  the sleep image is a system image similar to Windows Hiberfile.  The difference is that there is a wealth of information that can be gleaned from the sleepimage.  Since the subject matter is File Vault, we will limit the dicussion to it.  Passwords for file vault can ( and emphasize can, not always) be found in the sleep image.  Since everything is mostly plain text, a simple search can locate not only File Vault passwords, but a multitude of passwords.

b.So how do we find them.  Well, there are two ways.  from the command line create a grep expression that looks for text after "longname". This will locate all user name and passwords from the sleepimage. Look at all the hits.  the hits with the passwords, will have theuser name followed by "password" and the actual password in plain text. for example,

     strings -8 /var/vm/sleepimage | grep -A 4 -i longname

c.For windows examiners, Encase can be used to locate them as well. First from the tree pane navigate and locate the sleepimage. Blue check the sleep image and create a keyword for "longname".  Run the keyword search and minimize the search to the single blue checked sleepimage. Look at all the hits.  the hits with the passwords, will have the user name followed by "password" and the actual password in plain text.