I'm sorry to hear that.
It might depend on the version of 1password that is being used, but some online resources say it's somewhere located in the ~/Library/ subfolders on macOS:
https://discussions.agilebits.com/discus...ent_501834
https://discussions.agilebits.com/discus...ent_503342
it should be a .sqlite file, but this also depends on the version of 1password, older ones had a agilekeychain extension.
and as you already mentioned, it's probably also very different if the "cloud" feature was used.
after you found the file you need to use 1password2john.py with python 2.7 (yeah, that's probably important to not use newer python versions) from: https://raw.githubusercontent.com/magnum...rd2john.py
and make the hashes look similar to the ones mentioned over https://hashcat.net/wiki/example_hashes (i.e. remove the file names and colons etc).
Good luck
and all the best
oh, just found out that it's also mentioned here:
https://github.com/magnumripper/JohnTheR...ohn.py#L64
so that should be the first folder you should looking at and if not found search around for those file names within the ~/Library/ subfolders (might have changed just a little bit over time)
It might depend on the version of 1password that is being used, but some online resources say it's somewhere located in the ~/Library/ subfolders on macOS:
https://discussions.agilebits.com/discus...ent_501834
https://discussions.agilebits.com/discus...ent_503342
it should be a .sqlite file, but this also depends on the version of 1password, older ones had a agilekeychain extension.
and as you already mentioned, it's probably also very different if the "cloud" feature was used.
after you found the file you need to use 1password2john.py with python 2.7 (yeah, that's probably important to not use newer python versions) from: https://raw.githubusercontent.com/magnum...rd2john.py
and make the hashes look similar to the ones mentioned over https://hashcat.net/wiki/example_hashes (i.e. remove the file names and colons etc).
Good luck
and all the best
oh, just found out that it's also mentioned here:
https://github.com/magnumripper/JohnTheR...ohn.py#L64
so that should be the first folder you should looking at and if not found search around for those file names within the ~/Library/ subfolders (might have changed just a little bit over time)