11-15-2016, 09:50 PM
I am looking for information on how to retrieve the hash value from the plist file of an encrypted iTunes Backup. I know if i drop the file in Passware or Elcomsoft it'll do it automatically, but I don't feel like paying $1000 and then renewing licenses every year. I have been using hashcat for a few months now on NTLM and various others and love that it makes my job a lot easier.
And as someone gave the answer in a similar thread, Google it, I have and haven't had much luck. I have seen some reference to the keybag and looking at it in a plist editor or Hex editor, I guess I'm just missing the part of where the hash is within the data set that follows.
I apologize if it is that simple and I'm that stupid, but I'm just looking for some guidance or an answer. I get how to put the hash in to hashcat once I get it. I know it's in the manifest. It is for phone forensics for work, and I'm just running out of ideas. Thanks for any help.
If this is in the wrong area or inappropriate, please delete/move/yell at me.
And as someone gave the answer in a similar thread, Google it, I have and haven't had much luck. I have seen some reference to the keybag and looking at it in a plist editor or Hex editor, I guess I'm just missing the part of where the hash is within the data set that follows.
I apologize if it is that simple and I'm that stupid, but I'm just looking for some guidance or an answer. I get how to put the hash in to hashcat once I get it. I know it's in the manifest. It is for phone forensics for work, and I'm just running out of ideas. Thanks for any help.
If this is in the wrong area or inappropriate, please delete/move/yell at me.