hashcat Forum

My son died recently and I have been trying to get some information off his password-protected Macbook running OS X 13.0.1. I was able to get the .plist file. And I was able to get the hash with osx_extract_hash.py.

Then running hashcat -a 0 -m 7100 --username hash.txt rockyou.txt, it seems to be working.

However, I am not sure if this is the best way to t try to find the password. It has been running for almost a week now. I believe the password is several characters longer than password box to log in on the Mac and is like 2 to 5 dictionary words.

Is there anything that I can do to narrow my search to a longer password using 2 to 5 dictionary words and to speed up the process?

Thanks!

If you don't know anything more about the password than what you wrote, you won't speed up the cracking and basically without a GPU farm it will take forever. See how much the 8 RTX 4090 achieves on this hash:
24493.2 kH/s

I would do a wordlist of family members, birthdays and stuff your son liked etc, then use rules on it.

Since you have access to the raw files, I would consider attacking the Keychain as a faster solution.
Seer: https://github.com/hashcat/hashcat/issue...-645363447