2

I just ran into a situation where a user with a Mac that had been hard broken by an interrupted update needed into their Time Machine backup outside of the normal recovery process. Unfortunately, they'd forgotten the password to do this.

I have access to the filesystem on the broken Mac, and needed to recover their Time Machine password as well as anything else in the System keychain.

Difficulty: The system keychain does not use a normal password, it uses random bytes.

How do you decrypt a system keychain?

6

You need the following things:

  • One dead Mac with a readable filesystem (called the Source machine from here on)
  • One new Mac or Linux machine (called the Target machine from here on)

  • The System.keychain file from the source machine.

    • This file is located in either /System/Library/Keychains or /Library/Keychains
  • The SystemKey file from the source machine. This contains the actual password.
    • Located in in /var/db/SystemKey
  • Internet access on the target machine.

Step 1: Recovering the encryption key for the source keychain

We can't use SystemKey as is - it contains random bytes that can't be entered into a password dialog or command line. Even better, we need 24 bytes out of the middle of the file - after the magic number that indicates a key file, but before the checksum bytes.

The proper command to get the right hex key is:

hexdump -s 8 -n 24 -e '1/1 "%.2x"' /path/to/SystemKey && echo

Explained: Skip the first 8 bytes from the beginning of the file, continue 24 bytes after that, and use the format string to dump the data out on one line (it's a C-style printf string, if you're curious).

The && echo is so we get a single newline afterward so the output doesn't run into the beginning of your shell prompt after the command finishes.

Copy this string aside. This is the decryption key for the keychain.

Step 2: Dump the keychain using the password

We need a third party tool for this. We're going on the assumption that the dead Mac can't be booted in such a way that we can use its Keychain Access app normally.

That tool will be Chainbreaker - a python script. You'll need to install the hexdump library for Python. Run the following commands on the target machine:

  • sudo pip install hexdump
  • git clone https://github.com/n0fate/chainbreaker
  • cd chainbreaker

Now we simply give chainbreaker the key you just found and the file:

python chainbreaker.py -f /path/to/system.keychain -k (the byte string from step 1)

You'll see the plaintext password of everything in the system keychain. For my use case, I wanted the Time Machine password, and this will be represented in the output as a Generic password record named Time Machine. The plaintext password will be below.

Now we can simply use the Finder to open the Time Machine .sparsebundle, give the password we dug out of the keyfile, and continue as usual.

  • Solid instructions. Just recovered my Wifi passwords from a Time Machine backup with it. – Manuel Riel Apr 5 '18 at 0:21
  • Helpful answer. You imply we are using the third party tool because we don't have access to a functioning KeychainAccess program? I'm curious if this will work with Keychain Access directly...ie you load in the keychain off the old drive into KeyChain Access on the new computer and then unlock it using the password extracted from SystemKey. Doesn't seem to work at first glance but perhaps you can shed more light on why that will or won't work. In my case would like to migrate the items into a new keychain. – mattpr Nov 1 '18 at 17:45
  • @mattpr The problem you'd have with the normal keychain access program is that it's only going to try to unlock the keychain you added with SystemKey - which is a random binary file. And, since it's random binary, you can't insert it into a password dialog. There must be a way to do it, but sadly, I don't know what that is. – Mikey T.K. Nov 2 '18 at 20:21

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .