9

I saved an important password in an iCloud keychain, then deleted it there, and then forgot the password. Pretty dumb, I know. Still, is it somehow possible to get an older version of that keychain that still keeps the password?

3
  • Do you use Timemachine
    – markhunte
    Jan 22, 2015 at 17:37
  • @markhunte Yes, but how does it help?
    – Kinkou
    Jan 23, 2015 at 19:16
  • I am now not in front of my Mac. But if you go to your user library and then keychains. Select the keychains folder and make a manual backup. I.e make a copy somewhere. Then with the original keychain folder open. Go into timemachine and use it to try and find the date you had the password.it should allow you to restore the folder. And then you can get the password back. (Write it down)You can then restore back to a version done today in time machine. If this works let me know and I will add it as an answer when in front of my mac
    – markhunte
    Jan 23, 2015 at 19:35

5 Answers 5

2

I was just able to do this. Here's the procedure I took. I suspect some of these steps might be extraneous, but I didn't have time to experiment, so I went nuclear:

  1. Removed MacBook from network - unplugged cable, turned off AirPort
  2. Logged out of account.
  3. Logged in as different admin user, and restored the iCloud Keychain directory for the original, which, FYI is named a random UUID, e.g. 48579CB8-D696-401C-913F-E3F87181CFD2, and lives in /Users//Library/Keychains/. Obviously, you need sudo to do this.
  4. Restarted, and logged in original account
  5. Opened Keychain Access, found the relevant key, copied the password, etc. to a temporary location.
  6. Repeated steps 2 through 4, but instead, restoring the most recent version of the iCloud Keychain.

So, I was able to get the key that was accidentally deleted from the backup, but there was some ensuing weirdness:

First, I started getting Push Notification prompts saying my passwords were wrong for my standard Mail, Contacts & Calendar accounts.

Then, I opened Keychain Access, and noticed iCloud Keychain had returned to being Local Items (that's its name if you don't use iCloud Keychain).

Finally, I went to iCloud Preferences, and noticed that iCloud Keychain was now disabled. So, something in my procedure caused that. I turned it back on, gave it a minute, and all was right in the world.

Except... I had to re-enable Unlock my Mac with my Watch. Presumably, that's not restored from iCloud Keychain, which makes sense.

1

I just ran into the same situation and unfortunately no you cannot restore iCloud keychain from your own backup.

See Apple's support note on the topic https://support.apple.com/kb/PH20120, specifically:

Passwords stored in the iCloud keychain are encrypted and stored on your computer and can’t be copied.

As you, I tried copying other keychain files and 'keychain-db' files, but none of the iCloud passwords were contained in those.

0

Here's a procedure I followed that allowed me to recover an older accidentally overwritten password in my keychain (in my case Safari suggested a new password and asked if I wanted to update the password in my keychain before the website I was changing my password on rejected my new password). I found this easier to do the the method described by jaydisc. This method depends on using Time Machine backups, but since many Mac Users will have a few days of local backups on their machine, this often works.

  1. Go to my ~/Library/Keychains directory. There are directories with long UUIDs that contain the iCloud keychain (e.g., 871ED613-9835-5A2A-883B-1D25F123686F). Identify the directory corresponding to your current iCloud account - in my case there were several such directories but only one had a keychain-2.db file in it that had been recently updated.

  2. Disconnect from the network and quit the Keychain Access app.

  3. Rename the iCloud keychain directory to something else.

  4. Open Time Machine and navigate to the ~/Library/Keychains directory. Navigate to a backup prior to when the password was lost / changed. Restore the iCloud keychain directory.

  5. Exit Time Machine. At this point if you launch the Keychain Access app you will not be able to access any passwords stored in your iCloud keychain - MacOS needs network access to unlock the restored keychain file.

  6. Quit Keychain Access. Turn on the network and quickly launch Keychain Access. Click on your iCloud Keychain to verify that you can see items stored in it. Quickly disconnect from the network before the OS has a chance to synchronize the local keychain you just restored with what is stored on iCloud. Find your saved password in the restored keychain.

  7. If you want to go back to the most recent version of the keychain, before the old back you restored, quit Keychain access again. Copy the name of the iCloud keychain directory, delete it, and rename the old version of the iCloud keychain directory to the name you copied.

0

In my case, Airport network passwords had been deleted due to some sort of iCloud syncing error. I followed jaydisc's answer successfully, but I actually wanted to restore the keys instead of copying out individual passwords. I found a way of doing this.

After I restored the previous keychain directory (Library/Keychains/<UUID>) using jaydisc's answer, once the Mac connected to the Internet it would "update" to the version with the keys deleted.

However, before reconnecting to the Internet, if I caused the modification date of each key to be updated, I found the keys would remain in the keychain once reconnected to the Internet.

In the case of my Airport network password keys, I updated the Where attribute of each key from AirPort to something else, then changed them back to AirPort. This marked each key as newly modified, and allowed them to survive connecting back to the Internet.

-1

Restore either ~Users/[User]/Library/Keychains/login.keychain or ~Library/Keychains/System.keychain ( Select 'Keep both' option in Time Machine)

Open the newly restored file with the keyChain Access app.

You will be able to open the older entries in the restored file, and copy, or export them to your live keychain.

1
  • 1
    This is for the login keychain, not the iCloud keychain.
    – Noldorin
    May 15, 2017 at 1:33

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .