11-05-2025, 09:58 PM
Hi,
I recently tried to open my old timemachine backups, but i forgot the password. I searched all over the web, for the various formats that timemachine may use to store the hash, and i didn't get quite far. Most articles seem to mention a FileVault encrypted partition, or some newer technologies.
Is there anyone who knows how i would get the hash and or salt from this folder of files? And if this is even supported by hashcat?
Here is the folder structure of the backup:
The backup was initially created around 2013, and snapshots were added until 2014. I hope this gives enough indication on what type of encryption apple used.
I recently tried to open my old timemachine backups, but i forgot the password. I searched all over the web, for the various formats that timemachine may use to store the hash, and i didn't get quite far. Most articles seem to mention a FileVault encrypted partition, or some newer technologies.
Is there anyone who knows how i would get the hash and or salt from this folder of files? And if this is even supported by hashcat?
Here is the folder structure of the backup:
Code:
bands/
com.apple.TimeMachine.MachineID.bckup
com.apple.TimeMachine.MachineID.plist
com.apple.TimeMachine.Results.plist
com.apple.TimeMachine.SnapshotHistory.plist
Info.bckup
Info.plist
lock
mapped/
tokenThe backup was initially created around 2013, and snapshots were added until 2014. I hope this gives enough indication on what type of encryption apple used.