5

I saved an important password in an iCloud keychain, then deleted it there, and then forgot the password. Pretty dumb, I know. Still, is it somehow possible to get an older version of that keychain that still keeps the password?

  • Do you use Timemachine – markhunte Jan 22 '15 at 17:37
  • @markhunte Yes, but how does it help? – Kinkou Jan 23 '15 at 19:16
  • I am now not in front of my Mac. But if you go to your user library and then keychains. Select the keychains folder and make a manual backup. I.e make a copy somewhere. Then with the original keychain folder open. Go into timemachine and use it to try and find the date you had the password.it should allow you to restore the folder. And then you can get the password back. (Write it down)You can then restore back to a version done today in time machine. If this works let me know and I will add it as an answer when in front of my mac – markhunte Jan 23 '15 at 19:35
1

I just ran into the same situation and unfortunately no you cannot restore iCloud keychain from your own backup.

See Apple's support note on the topic https://support.apple.com/kb/PH20120, specifically:

Passwords stored in the iCloud keychain are encrypted and stored on your computer and can’t be copied.

As you, I tried copying other keychain files and 'keychain-db' files, but none of the iCloud passwords were contained in those.

0

Restore either ~Users/[User]/Library/Keychains/login.keychain or ~Library/Keychains/System.keychain ( Select 'Keep both' option in Time Machine)

Open the newly restored file with the keyChain Access app.

You will be able to open the older entries in the restored file, and copy, or export them to your live keychain.

  • This is for the login keychain, not the iCloud keychain. – Noldorin May 15 '17 at 1:33
0

I was just able to do this. Here's the procedure I took. I suspect some of these steps might be extraneous, but I didn't have time to experiment, so I went nuclear:

  1. Removed MacBook from network - unplugged cable, turned off AirPort
  2. Logged out of account.
  3. Logged in as different admin user, and restored the iCloud Keychain directory for the original, which, FYI is named a random UUID, e.g. 48579CB8-D696-401C-913F-E3F87181CFD2, and lives in /Users//Library/Keychains/. Obviously, you need sudo to do this.
  4. Restarted, and logged in original account
  5. Opened Keychain Access, found the relevant key, copied the password, etc. to a temporary location.
  6. Repeated steps 2 through 4, but instead, restoring the most recent version of the iCloud Keychain.

So, I was able to get the key that was accidentally deleted from the backup, but there was some ensuing weirdness:

First, I started getting Push Notification prompts saying my passwords were wrong for my standard Mail, Contacts & Calendar accounts.

Then, I opened Keychain Access, and noticed iCloud Keychain had returned to being Local Items (that's its name if you don't use iCloud Keychain).

Finally, I went to iCloud Preferences, and noticed that iCloud Keychain was now disabled. So, something in my procedure caused that. I turned it back on, gave it a minute, and all was right in the world.

Except... I had to re-enable Unlock my Mac with my Watch. Presumably, that's not restored from iCloud Keychain, which makes sense.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .