Backup of hardrive suddenly encrypted (Mac)

Discussion in 'Computer Software and Operating Systems' started by MichiS97, Dec 28, 2015.

  1. MichiS97
    OP

    MichiS97 "Leftist snowflake milennial"

    Member
    GBAtemp Patron
    MichiS97 is a Patron of GBAtemp and is helping us stay independent!

    Our Patreon
    1,288
    718
    Jun 14, 2011
    Gambia, The
    Bavaria
    Hey,

    first of all, I'm actually posting here to help a friend so everything I'm writing here is second-hand information, so I'm sorry if some things might be a little bit weird.

    Okay, so here's the deal: A friend of mine wanted to upgrade his Macbook from Yosemite to El Captain and while upgrading the Macbook froze which led to a kernel panic. Of course it failed to boot from this point on so he booted into Safe Mode to make a backup image of his harddrive and put that on an external HDD. After finally successfully updating to El Captain and now it's telling him that the backup image on his external drive is encrypted. He says he's 100% sure that he hasn't entered any sort of password or anything, he just made a normal backup using Safe Mode. This backup contains four years of work in a band he's in and lots of other personal stuff so it's needless to say he's kinda desperate. He already went to an Apple Store but they told him they couldn't decrypt it for him because of data protection laws, I mean that's pretty obvious, but still worth a shot.
    Do you know if there is any way to decrypt an image like this? Like I said, he didn't enter a password or anything, so might there be some kind of default encryption key? I've never even used a Mac so that's why I'm asking you guys for help.

    Thanks in advance!
     
  2. nando

    nando GBAtemp Addict

    Member
    2,131
    395
    Jan 1, 2008
    United States
    if he didn't enter any password than it was likely encrypted with the admin password of the previous system.
     
  3. MichiS97
    OP

    MichiS97 "Leftist snowflake milennial"

    Member
    GBAtemp Patron
    MichiS97 is a Patron of GBAtemp and is helping us stay independent!

    Our Patreon
    1,288
    718
    Jun 14, 2011
    Gambia, The
    Bavaria
    He says he already tried that.
     
  4. MichiS97
    OP

    MichiS97 "Leftist snowflake milennial"

    Member
    GBAtemp Patron
    MichiS97 is a Patron of GBAtemp and is helping us stay independent!

    Our Patreon
    1,288
    718
    Jun 14, 2011
    Gambia, The
    Bavaria
    *bump*
    (I actually hate myself for doing this but I'm still hoping that someone could help us)
     
  5. nando

    nando GBAtemp Addict

    Member
    2,131
    395
    Jan 1, 2008
    United States
    maybe if you explain how he made the backup? did he use disk utility, time capsule, third party app? was filevault activated at the time?

    filevault is the only way i can think of that would encrypt the dmg without asking for a password. it encrypts everything on the hd, when you are viewing files in the computer there is no hint of encryption till you move them to another computer. but this password should be the root password. maybe your friend changed passwords at some point or he set a root password and forgot? you can also set a different password for filevault, is this something he did and forgot about?

    but really you should probably ask in a more mac friendly community. i doubt anyone here can actually help you.

    here is blog from a guy in a similar situation. he resorted to cracking

    https://blog.whitehatsec.com/cracking-aes-256-dmgs-and-epic-self-pwnage/

    you may also try accessing the backup from a windows computer
     
    Last edited by nando, Dec 31, 2015