View Keychain from encrypted IOS 8.2 backup?

Question

Is there any way to access the keychain from an Iphone 5 IOS 8.2 backup?

Here are the hard facts:

• encrypted backup where I KNOW the password
• device is lost

So far I could restore all the (important) files just fine, however I am stuck on how to view my saved passwords. Apple support sites only show me how to restore a backup, but not how to read it. After searching for quite some time I found two possibilities:

1. Decrypting the iPhone keychain from backups

This requires me to have not only any iPhone (like the Apple support pages) but even the original one, which I have the backup of. So that's not possible.

2. Elcomsoft Phone Breaker

This seems to work. I downloaded the demo version, which shows which passwords are saved on the backups, but not what they are. However, the cheapest version for OS X is 199€.

Isn't there any other way to access my data for free?

Answer 1

I had the same problem and found a great article that helped me decrypt the keychain from my iOS 9 backup: Recovering Google Authenticator Keys from iOS Backups.

Here are the steps for El Capitan:

• Install pip: sudo easy_install pip

• Install m2crypto (see answer to Trouble installing m2crypto with pip on El Capitan)

  • First, install openssl and swig with Homebrew: brew install openssl swig

  • Then install m2crypto using pip:

    env LDFLAGS="-L$(brew --prefix openssl)/lib" \
    CFLAGS="-I$(brew --prefix openssl)/include" \
    SWIG_FEATURES="-cpperraswarn -includeall -I$(brew --prefix openssl)/include" \
    pip install --user m2crypto
    

• Install some more Python packages:

  pip install --user construct progressbar pycrypto pyasn1
  

• Download the iPhone Data Protection Tools
• Extract your backup: python backup_tool.py PATH_TO_BACKUP

• And finally, decrypt your keychain:

  python keychain_tool.py -d "PATH_TO_extract/KeychainDomain/keychain-backup.plist" "PATH_TO_extract/Manifest.plist"
  

Answer 2

Try this tutorial - how to decrypt keychain

http://www.securitylearn.net/2012/05/03/decrypting-the-iphone-keychain-from-backups/