Find and decode bytes containing passphrase hint (CryptoUsers structure) in FileVault Drive Encryption of HFS+ encrypted drive

Question

I had a Mac computer running macOS 10.14.6 (I believe) and set up a Time Machine backup with encryption on a hard drive. It is encrypted with HFS+ with a password and a hint. The password was stored on the local keychain and I ran backups 3 times a week.

Then I got my computer stolen. I connect the encrypted drive to another computer and I do not see the hint (it seems an unresolved issue):

I contacted Apple for support and visited a store, but they adamant that the hint is not on the drive, and that doing so would be a security risk. This seems backwards to me because then there is no advantage to having a hint if it only shows on the same device where you can save the password in the first place.

By chance I discovered that APFS drives do show a hint. As for HFS+:

[the hint] is stored in the "PassphraseHint" entry of the "CryptoUsers" structure in the "com.apple.corestorage.lvf.encryption.context" structure in the CoreStorage XML plist on the encrypted drive. You can read the specifics here FileVault Drive Encryption

The same thread shows that this CoreStorage XML plist on the encrypted drive is encoded:

The PLIST is compressed using DEFLATE and the hint itself might be base64 encoded. You'll need to decompress the data before searching for the hint, if you want to find it manually that way.

and that PLIST may be outside the encrypted partition:

The encryption context plist either the EncryptedRoot.plist.wipekey stored on the "Recovery HD" partition of the system disk that also contains the FileVault encrypted volume, or the XML plist-like data identified as "com.apple.corestorage.lvf.encryption.context" stored in the encrypted metadata, contains the encrypted VMKs necessary to unlock the encrypted volume.

How user's name can be displayed before disk is decrypted, when FileVault is turned on? handles a related question where a drive has a Preboot volume. Following those steps, I ran:

$ diskutil list
/dev/disk0 (internal, physical):
...
/dev/disk1 (synthesized):
...
/dev/disk2 (external, physical):
   #:                       TYPE NAME                    SIZE       IDENTIFIER
   0:      GUID_partition_scheme                        *240.1 GB   disk2
   1:                        EFI EFI                     209.7 MB   disk2s1
   2:          Apple_CoreStorage Time Machine Encryped   239.7 GB   disk2s2
   3:                 Apple_Boot Boot OS X               134.2 MB   disk2s3

Offline
                                 Logical Volume Time Machine Encryped on disk2s2
                                 2930C7CC-4EE4-43AB-B1FB-81756A1CC0E5
                                 Locked Encrypted

Following one answer the hint should be in the Apple_CoreStorage volume itself. I mount that volume with:

$ sudo mkdir /Volumes/Apple_CoreStorage
$ sudo mount -t hfs /dev/disk2s2 /Volumes/Apple_CoreStorage

and I get prompted for the encryption password in the same way as if I had mounted it:

How can I find the bytes that contain the CryptoUsers or CoreStorage XML plist on the encrypted drive, decode them with base64, and see the hint in plaintext?

Answer 1

I detailed how to find the hint in my earlier answer to you here:

Which encrypted items show a hint?

In particular, the hint is NOT stored on the EFI or boot partitions. It is stored (if it is indeed stored on the drive) inside the encrypted partition (the one named "Time Machine Encryped" in your case).

As I detailed in my earlier answer, this particular information is NOT encrypted with your actual passphrase (which would have defeated the purpose of a password hint), instead it is encrypted with a different key (derived from the volume identifier). So essentially the key for decrypting the information is stored in cleartext on the the drive itself.