Where to target when doing a Brute Force attack on an extended mac OS drive?
John the Ripper is for finding the logon password for user accounts, it doesn't decrypt encrypted drives.

There ae tools to decrypt the encrypted drive but they requie the password to be in memory on the host mac system. They are also very expensive.Passware http://www.lostpassword.com apparently have products that can do this.

http://www.esecurityplanet.com/mac-os-security/passware-cracks-apples-filevault-encryption.html