2

I have several .sit files (compressed directories photos or text documents) from from the early 00's that I encrypted under OS 9 (I think). I have the password. I've tried extracting these using the Unarchiver, but of course, I didn't expect it to work on the encrypted files.

Is there any way of decrypting and unstuffing these old files?

  • 1
  • @JBis - post as an answer. Still exists after all these years, still works, still free [for the basic expander structure] – Tetsujin Jul 11 '18 at 19:18
  • 1
    @JBis - yes, should do. It is still fully supported & ought to still be good for any older versions including password-protected. [I keep it around for the odd occasion it can decompress something 'odd'. It's still actually one of the best, even though it has fallen in the popularity stakes. 'sit' is Stuffit's own format, so any password/decryption error is unlikely to be the fault of Stuffit Expander itself. – Tetsujin Jul 11 '18 at 19:21
  • 1
    @JBis - I'm watching this develop... it's now looking like the .sit is the least of our worries... "some random encryption" happened afterwards... so the 'random' needs now to be reduced to a single 'fact'. Flagging as 'unclear' until we get that in the OP. – Tetsujin Jul 11 '18 at 19:36
  • 1
    @Tetsujin I asked on InfoSec if anyone knows what encryption algorithm was used in Mac OS 9 but I doubt we will get response. – JBis Jul 11 '18 at 19:39
1

I figured it out! Again, this is for a situation when you know the password.

  1. Download an OS9 emulator. I used SheepShaver and found a perfect bundle with everything here.
  2. If OS9 detects that the file is encrypted (i.e. the files appears with a little yellow key symbol in the corner of the icon), try double-clicking on it or opening it through "Apple File Security" under Applications > Security.
  3. If you get the error, The "Apple File Security " could not be opened because "KeychainLib" could not be found,
    • Go to the Extensions Manager.
    • Under Control Panel, enable Keychain Access
    • Under Extensions, enable everything that starts with the word "Security".
    • Then restart.
  4. If OS9 does not detect that the file is encrypted (i.e. no little lock symbol), you may have luck changing the file attributes as per the suggestion here (it goes without saying you should try this on a copy of your file first):
    • In your normal OSX terminal, use xattr -w -x 'com.apple.FinderInfo' '65 6E 63 32 63 72 70 32 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00' yourfile.ext
    • This should signal to OS9 the file is encrypted and you should then see the little lock symbol.
  5. Try double-clicking the file. If you get the error, A file error has occurred. The file may be damaged, try dragging the file to the OS9 desktop (instead of trying to decrypt it within the directory shared between OS9 and OSX).
  6. When prompted, say you want to decrypt the file and type the passcode.
  7. Unstuff the file with Stuffit Expander (in OS9).
  8. Presto! Now you can bring the files back to the present.
0

Assuming you are talking about .sit encrypted (not the actual file encrypted like with OpenSSL), you can use StuffIt Expander Mac. Although old, it works well and should be able to decrypt & decompress your .sit's. Its free too!


UPDATE:

I assumed wrong.

  • The .sit file was encrypted using the OS 9 'encrypt' function, if I remember correctly. Not sure if that is OpenSSL, I just know it was an option from the mac menu bar at the time. – Amyunimus Jul 11 '18 at 19:29
  • @Amyunimus What encryption algorithm was used? – JBis Jul 11 '18 at 19:31
  • @Amyunimus Was it DES des.online-domain-tools.com? – JBis Jul 11 '18 at 19:32
  • I'm trying to determine what it was -- so far, it sounds like it was encrypted using a 56-bit RC5 key as part of "Apple File Security" – Amyunimus Jul 11 '18 at 19:42
  • @Amyunimus 8gwifi.org/CipherFunctions.jsp – JBis Jul 11 '18 at 19:45

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .