Hash Mode 7100 Hashes

[SteveG]

My son died recently and I have been trying to get some information off his password-protected Macbook running OS X 13.0.1. I was able to get the .plist file. And I was able to get the hash with osx_extract_hash.py.

Then running hashcat -a 0 -m 7100 --username hash.txt rockyou.txt, it seems to be working.

However, I am not sure if this is the best way to t try to find the password. It has been running for almost a week now. I believe the password is several characters longer than password box to log in on the Mac and is like 2 to 5 dictionary words.

Is there anything that I can do to narrow my search to a longer password using 2 to 5 dictionary words and to speed up the process?

Thanks!

[marc1n]

If you don't know anything more about the password than what you wrote, you won't speed up the cracking and basically without a GPU farm it will take forever. See how much the 8 RTX 4090 achieves on this hash:
24493.2 kH/s

[lapsikmees]

I would do a wordlist of family members, birthdays and stuff your son liked etc, then use rules on it.

[Banaanhangwagen]

Since you have access to the raw files, I would consider attacking the Keychain as a faster solution.
Seer: https://github.com/hashcat/hashcat/issue...-645363447