4

I make a terrible mistake. I totally lost my paper with the secret password for my encrypted external GUID hard drive. This external drive contains many pictures but also some works documents very usefull. So it would be very interesting for me to get through this password.

I can remember maybe 50% of my password.I calculated that with the known part of my password I will have a maximum of 250 000 possible combination. A program like crunch could do the list of all the combination but I think it is not the most difficult part of this mission.

I have to build a small program to fill the dialog box and trying all the 250 000 combination. I already tried to do this with Apple Script but I didn’t found the command to fill in the combination in the dialog box “Enter a password to unlock the disk”. This dialog box appear when we plug the disk to the mac.

Does somebody know well applescript to helping me to interact with this unlocker disk dialog box? Or maybe somebody have an other solution to unlock it without applescript?

If somebody is interested to helping me I will be very grateful.

  • 1
    Trying to crack an encrypted volume via AppleScript is IMO absolutely the wrong way to go about it! I'd probably opt for using a loop in a bash script with the diskutil command line utility. I believe it would be faster in processing the number of possible combinations and would probably deal with the failed attempts in a better manner then through the GUI and AppleScript. – user3439894 Apr 30 '16 at 21:42
  • I don't know if you've seen my answer yet, however I've update the code and other info. So you might want to look at the updated code and sample output. – user3439894 May 2 '16 at 0:28
6

As a proof of concept, I formatted a USB Thumb-drive using a GUID Partition Map and formatted it Mac OS Extended (Journaled) naming it "Encrypted".

Then in Finder, I selected the disk named "Encrypted" and control-clicked selecting Encrypt "Encrypted"..., while setting its password to "password".

When it was done encrypting, using Terminal, I ascertained the UUID I'd need to use with the diskutil command in my script with the following command: diskutil cs list

I wanted the UUID of the Logical Volume where it showed Volume Name: Encrypted and in this case it showed it as:

Logical Volume 1BFD0C99-1A67-4DC2-A0F4-199B2AE635B0

Here's the output of diskutil cs list, so as to see from what I drew the UUID.

$ diskutil cs list
CoreStorage logical volume groups (1 found)
|
+-- Logical Volume Group 3D8D6165-909C-4C55-8C0B-811AC4856773
    =========================================================
    Name:         Encrypted
    Status:       Online
    Size:         15270830080 B (15.3 GB)
    Free Space:   16777216 B (16.8 MB)
    |
    +-< Physical Volume 1E6C582B-5822-4986-9F41-164DE662FCE1
    |   ----------------------------------------------------
    |   Index:    0
    |   Disk:     disk2s2
    |   Status:   Online
    |   Size:     15270830080 B (15.3 GB)
    |
    +-> Logical Volume Family 6D7E4DCE-D7C5-4383-BF88-9E2DB9A52E14
        ----------------------------------------------------------
        Encryption Status:       Unlocked
        Encryption Type:         AES-XTS
        Conversion Status:       Complete
        Conversion Direction:    -none-
        Has Encrypted Extents:   Yes
        Fully Secure:            Yes
        Passphrase Required:     Yes
        |
        +-> Logical Volume 1BFD0C99-1A67-4DC2-A0F4-199B2AE635B0
            ---------------------------------------------------
            Disk:               disk3
            Status:             Online
            Size (Total):       14935281664 B (14.9 GB)
            Size (Converted):   -none-
            Revertible:         Yes (unlock and decryption required)
            LV Name:            Encrypted
            Volume Name:        Encrypted
            Content Hint:       Apple_HFS
$ 

With now having the correct UUID, I created my bash script in Terminal:

touch unlock
open unlock

I then added the following code:

#!/bin/bash

if [[ ! -z $1 ]]; then
    while read -r line; do
        printf "   Testing: $line \n"
        diskutil coreStorage unlockVolume 1BFD0C99-1A67-4DC2-A0F4-199B2AE635B0 -passphrase "$line" 2>/dev/null
            if [[ $? -eq 0 ]]; then
                printf "\n   The correct password is: $line \n\n"
                exit 0
            fi
    done < "$1"
else
    printf "\n   Missing Dictionary File!...\n\n   Syntax: ./unlock dictionary.txt\n\n"
    exit 1
fi

Note: Replace the UUID above with the UUID of the Logical Volume of your encrypted drive.

Picture of Sublime Text showing the code.

I saved and closed the script named "unlock" and made it executable using:

chmod u+x unlock

I then created a dictionary file, touch dictionary.txt and populated the file. Of course in your case, you'd use as you mentioned the program named crunch to create your dictionary file(s).

I then ejected and remove the USB Thumb-drive from my system.

I then plugged in the USB Thumb-drive and when the "Enter a password to unlock the disk "Encrypted"." dialog box appeared, I clicked the Cancel button.

Now I was ready to unlock it using the bash script and dictionary.txt file from Terminal.

To show what I put in the dictionary.txt file:

$ cat dictionary.txt
p
pa
pass
passw
password
passwo
passwor
$ 

Here's the output of: ./unlock dictionary.txt

$ ./unlock dictionary.txt
   Testing: p 
Started CoreStorage operation
   Testing: pa 
Started CoreStorage operation
   Testing: pass 
Started CoreStorage operation
   Testing: passw 
Started CoreStorage operation
   Testing: password 
Started CoreStorage operation
Logical Volume successfully unlocked
Logical Volume successfully attached as disk3
Logical Volume successfully mounted as /Volumes/Encrypted
Core Storage disk: disk3
Finished CoreStorage operation

   The correct password is: password 

$

As you can see it tried what was in the dictionary.txt file up until if found the correct password and when the correct password was tested it unlocked and mounted the disk, prints out what the correct password was and exits the script.

The reason for printing out all passwords, is so if you need to stop the script you can then remove the tried passwords from the dictionary.txt file before starting again.

Note: It is important that before running the bash script you have first freshly plugged in the drive and clicked the Cancel button, then run the script.

  • A new user wonders if they should ask a new question or if your script above can handle or be adapted for core storage LV or if it should work out of the box. My guess is you already handle core storage and they need a new thread or help with getting the correct GUID to adapt it to their situation – bmike Mar 5 '18 at 18:35
  • @user3439894 I tried this workflow on a macbook air hard drive from another mac computer connected thought the target disk mode boot option. When I run the script the terminal does not print does the; Started CoreStorage operation lines. It just prints the Testing: password lines. Is this happening because the hard drive I am trying to unlock does not have a CoreStorage option? If so will the bash script still work for unlocking an internal MacHard drive? – Buck Crockett Jun 6 at 3:21
  • @Buck Crockett, As my answer starts off, "As a proof of concept" and it was in response to a particular give scenario of the OP, namely... "encrypted external GUID hard drive" with the keyword being "external", coupled with the explicit condition stated at the end of my answer, "Note: It is important that before running the bash script you have first freshly plugged in the drive and clicked the Cancel button, then run the script". As to being able to adapt this to an internal hard drive that's connected as a target disk, well with not being able to test, I just can't say for sure, sorry. – user3439894 Jun 6 at 12:12

You must log in to answer this question.

protected by Community Jun 6 at 4:25

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged .