FileVault was introduced with Mac OS X 10.3 Panther,[1] and could only be applied to a user's home directory, not the startup volume. The operating system uses an encrypted sparse disk image (a large single file) to present a volume for the home directory. Mac OS X 10.5 Leopard and Mac OS X 10.6 Snow Leopard use more modern sparse bundle disk images[2] which spread the data over 8 MB files (called bands) within a bundle. Apple refers to this original iteration of FileVault as "legacy FileVault".[3]
OS X 10.7 Lion and newer versions offer FileVault 2,[3] which is a significant redesign. This encrypts the entire OS X startup volume and typically includes the home directory, abandoning the disk image approach. For this approach to disk encryption, authorised users' information is loaded from a separate non-encrypted boot volume[4] (partition/slice type Apple_Boot).
https://github.com/libyal/libfvde
https://github.com/libyal/libfvde