I had a Mac computer running macOS 10.14.6 (I believe) and set up a Time Machine backup with encryption on a hard drive. It is encrypted with
HFS+ with a password and a hint. The password was stored on the local keychain and I ran backups 3 times a week.
Then I got my computer stolen. I connect the encrypted drive to another computer and I do not see the hint (it seems an unresolved issue):
I contacted Apple for support and visited a store, but they adamant that the hint is not on the drive, and that doing so would be a security risk. This seems backwards to me because then there is no advantage to having a hint if it only shows on the same device where you can save the password in the first place.
By chance I discovered that APFS drives do show a hint. As for HFS+:
[the hint] is stored in the "PassphraseHint" entry of the "CryptoUsers" structure in the "com.apple.corestorage.lvf.encryption.context" structure in the CoreStorage XML plist on the encrypted drive. You can read the specifics here FileVault Drive Encryption
The same thread shows that this CoreStorage XML plist on the encrypted drive is encoded:
The PLIST is compressed using DEFLATE and the hint itself might be base64 encoded. You'll need to decompress the data before searching for the hint, if you want to find it manually that way.
and that PLIST may be outside the encrypted partition:
The encryption context plist either the EncryptedRoot.plist.wipekey stored on the "Recovery HD" partition of the system disk that also contains the FileVault encrypted volume, or the XML plist-like data identified as "com.apple.corestorage.lvf.encryption.context" stored in the encrypted metadata, contains the encrypted VMKs necessary to unlock the encrypted volume.
How user's name can be displayed before disk is decrypted, when FileVault is turned on? handles a related question where a drive has a
Preboot volume. Following those steps, I ran:
$ diskutil list
/dev/disk0 (internal, physical):
/dev/disk2 (external, physical):
#: TYPE NAME SIZE IDENTIFIER
0: GUID_partition_scheme *240.1 GB disk2
1: EFI EFI 209.7 MB disk2s1
2: Apple_CoreStorage Time Machine Encryped 239.7 GB disk2s2
3: Apple_Boot Boot OS X 134.2 MB disk2s3
Logical Volume Time Machine Encryped on disk2s2
Following one answer the hint should be in the
Apple_CoreStorage volume itself. I mount that volume with:
$ sudo mkdir /Volumes/Apple_CoreStorage
$ sudo mount -t hfs /dev/disk2s2 /Volumes/Apple_CoreStorage
and I get prompted for the encryption password in the same way as if I had mounted it:
How can I find the bytes that contain the CryptoUsers or CoreStorage XML plist on the encrypted drive, decode them with base64, and see the hint in plaintext?