1

For ease of the reader, the short version:

MacBook Pro running Mountain Lion. A user has forgotten his FileVault password and master recovery code. FileVault 2 is not enabled, just the user's home directory is encrypted and exists as a sparsebundle. I would crack the sparsebundle but I'm having troubles getting the hash. All I really want/need to do is be able to decode the user folder so that its data can be accessed again.

BTW, I saw somewhere that you can have apple reset the FileVault password using your Apple ID? Is this true when FileVault 2 full-disc encryption is not enabled?

The long version:

This involves a Macbook Pro running Mountain Lion where the user changed their user password and cannot remember either the original password, nor the password it was changed to. All that they remember about the passwords were that they were not real words, as they were acronyms of the first letter of every word in a sentence (which he doesn't remember either), lower and uppercase and likely contained some symbols. It could be anywhere from 4-9 characters long. To regain access to the computer, I booted in single-user mode and made myself an admin account, then used that account to change the original user's login password. Now when the original user logs in with the new password, he is told that his filevault password is not his login password and that he needs to enter the old password before he can even login. Problem is, of course, he doesn't remember it. No does he know the filevault master recovery code.

Here's what I think I know so far: It would be useless to crack the user password, since it's already known. I'm still kinda iffy on keychains, but they only store the current password, correct? Previous user login passwords are not stored anywhere, are they?

Speaking of keychains, I have both the public and private keys for the master filevault keychain. Is there anything I can do with these to unlock the filevault master keychain without knowing the filevault password? Or can I somehow use these to decode the sparsebundle?

The Macbook Pro is running OSX Mountain Lion but filevault 2 is NOT enabled, just the user folder is encrypted and exists as a sparsebundle. I changed permissions so that I could access the sparsebundle... from what I understand I could either try cracking the master.filevault keychain or the sparsebundle itself. From something I read, I am led to believe that the sparsebundle's hash might be unsalted because it's an upgraded Mac? I assume that meant because it was calculated in an older version of OSX that didn't salt the hashes, but I don't really know.

With regards to the master.filevault keychain, the hash is in plaintext, surrounded by zeros, correct? It doesn't really matter I suppose, as trying to crack it would likely be too difficult since I'd have to just brute force it with upper and lower case letters, symbols and 4-9 characters. I have a forensic computer with 3xATI video cards ready and waiting, but it said something like 320,000 years. (Side question: is it possible to use a dictionary list as words that the password will NOT be? The password here, if you remember, was the first letter of every word of some phrase so it's definitely NOT an english word or a variant of one.)

So, I guess I'm gonna give cracking the sparseimage bundle a try; can anyone tell me how to get the hash for it? Is it really in /private/var/db/shadow under the user's GUID? Is this the hash of the filevault password for the user, or just of the user's login password? What I read was somewhat unclear on that point and the directions on how to pull the hash from the GUID file were kinda confusing.

What I'm asking, I suppose, is if anyone can help me; all I really want/need to do is be able to decode the user folder so that its data can be accessed again. Whether this is by unlocking the filevault.master keychain, somehow using the private key and certificate of the filevault.master keychain to bestow access, cracking the sparsebundle image's password or whatever else, I don't care. If you know how I can get it done, I'm all ears.

BTW, I saw somewhere that you can have apple reset the filevault password using your Apple ID? Is this only for filevault 2 whole disk encryption, or does it apply to all files/folders encoded with filevault? Does it only work on Maverick? I'd love for this to be true, since his Apple ID is perhaps the ONLY password he actually remembers.

Any help would be welcomed- thanks in advance for the answer ;)

Improve this question
4
  • Your own answer to apple.stackexchange.com/questions/80060/… doesn't help here?
    – nohillside ♦
    Commented Nov 11, 2014 at 7:29
  • No, when I try to open up thefile which contains the hash, it looks nothing like the one in the example... no nice 00s and then octects- there's stuff kinda everywhere, such that I was not sure where the hash is... gonna go and look again, tho maybe I was just dumb when I looked at it earlier
    – Ron Kyle
    Commented Nov 13, 2014 at 2:24
  • Actually, it doesn't help (I THINK) because it assumes that the user password is the same as the filevault password (which in this case it is not) and tells you how to get the user password hash. This is what I was unsure of.
    – Ron Kyle
    Commented Nov 13, 2014 at 23:36
  • @Ron Kyle: It's been a while, how did the story end? I've been looking at a FileVaultMaster.keychain and could not determine the internal structure of the file and where the hash might be located as I found several sections containing key-like hex-garble. Regarding your side-question of using a dictionary as a not-to-try filter: I don't think that such is possible and considering the possible performance-impact on the pwd-candidate-generation probably makes little sense. Oh, and Passware (tm) seems to be able to recover the FVMaster.keychain pwd somehow, but rather slow/without using GPU.
    – antiplex
    Commented Sep 1, 2015 at 10:43

1 Answer 1

Reset to default
1

If you can unlock the FileVaultMaster.keychain, you may be able to recover the user's data from the encrypted disk image. I have a guide available from here in PDF format:

https://app.box.com/s/g3z57u54xc3fz6sr1tfn

The section you'll want to reference is the Command-line FileVault Recovery part of the Section VII: Troubleshooting FileVault documentation. That section covers troubleshooting and data recovery for legacy FileVault.

Improve this answer
6
  • Okay, here's my question. If I reset the filevault master password by deleting the keychain, will the filevault master keychain/password then work to decrypt the sparsebundle? The sparsebundle is the user folder of a user that does NOT have filevault enabled. Thanks.
    – Ron Kyle
    Commented Dec 5, 2014 at 8:23
  • No, it won't, to answer my own question.
    – Ron Kyle
    Commented Dec 5, 2014 at 10:07
  • 1
    Unfortunately, deleting the existing keychain means that the recovery option that leverages FileVaultMaster.keychain now won't work. This is because the FileVaultMaster.keychain’s contents are what actually do the recovery. FileVaultMaster.keychain is a FileVault-specific keychain, whose contents are an SSL certificate and an private key. These two keys are specifically used for FileVault certificate-based authentication. When both keys are available, you can use them to unlock or decrypt the encrypted sparsebundle encryption without knowing the password of the FileVault-encrypted account.
    – Rich Trouton
    Commented Dec 6, 2014 at 4:10
  • REALLY? That's what I've been trying to figure out; I really felt that that should be possible. I have both the public and private keys, but apparently I'm a dumb-butt who can't figure out how to use them and when I search for info about public and private keys, etc, I found NOTHING regarding how to use the keys together to NOT have to know the password. I figured that this meant it was either not possible or it was so well and widely known that no one has bothered to explain it anywhere. Oh wait, do you have to know the filevault master password and unlock the master.keychain to do it?
    – Ron Kyle
    Commented Dec 11, 2014 at 0:37
  • Unfortunately, the filevaultmaster.keychain is 1024-bit encoded, so I've little to no chance of EVER brute forcing THAT... I guess the encrypted sparsebundle is only a 128-bit encryption and within the reach of my cracking rig. However, I've had no luck in locating the hash of said password in the sparsebundle. I found where you are supposed to join the token file withthefirst band and then look at it in a hex editor, change a bit or two and then dmg2john.py is supposed to pull something (NOT the hashed pass, I guess) that JohnTheRipper can use to crack the pass. Do you know any other options?
    – Ron Kyle
    Commented Dec 11, 2014 at 0:45

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .