Backup of hardrive suddenly encrypted (Mac)

[MichiS97]

Hey,

first of all, I'm actually posting here to help a friend so everything I'm writing here is second-hand information, so I'm sorry if some things might be a little bit weird.

Okay, so here's the deal: A friend of mine wanted to upgrade his Macbook from Yosemite to El Captain and while upgrading the Macbook froze which led to a kernel panic. Of course it failed to boot from this point on so he booted into Safe Mode to make a backup image of his harddrive and put that on an external HDD. After finally successfully updating to El Captain and now it's telling him that the backup image on his external drive is encrypted. He says he's 100% sure that he hasn't entered any sort of password or anything, he just made a normal backup using Safe Mode. This backup contains four years of work in a band he's in and lots of other personal stuff so it's needless to say he's kinda desperate. He already went to an Apple Store but they told him they couldn't decrypt it for him because of data protection laws, I mean that's pretty obvious, but still worth a shot.
Do you know if there is any way to decrypt an image like this? Like I said, he didn't enter a password or anything, so might there be some kind of default encryption key? I've never even used a Mac so that's why I'm asking you guys for help.

Thanks in advance!

 

[nando]

if he didn't enter any password than it was likely encrypted with the admin password of the previous system.

 

[MichiS97]

if he didn't enter any password than it was likely encrypted with the admin password of the previous system.

He says he already tried that.

 

[MichiS97]

*bump*
(I actually hate myself for doing this but I'm still hoping that someone could help us)

 

[nando]

maybe if you explain how he made the backup? did he use disk utility, time capsule, third party app? was filevault activated at the time?

filevault is the only way i can think of that would encrypt the dmg without asking for a password. it encrypts everything on the hd, when you are viewing files in the computer there is no hint of encryption till you move them to another computer. but this password should be the root password. maybe your friend changed passwords at some point or he set a root password and forgot? you can also set a different password for filevault, is this something he did and forgot about?

but really you should probably ask in a more mac friendly community. i doubt anyone here can actually help you.

here is blog from a guy in a similar situation. he resorted to cracking

https://blog.whitehatsec.com/cracking-aes-256-dmgs-and-epic-self-pwnage/

you may also try accessing the backup from a windows computer