Information Technology Reference
In-Depth Information
iPhone Data Protection Tools contain Python scripts to decrypt the keychain file from the
encrypted backup. To decrypt the keychain, run the following command in a terminal win-
dow and enter the backup password when prompted. The script also prompts to enter the
key 0x835 ; press Enter if you don't have the key 0x835 .
$sudo python keychain_tool.py -d "/Users/satishb3/Library/
Application Support/MobileSync/Backup/
6c1b7aca59e2eba6f4635cfe7c4b2de1bd812898_extract/
KeychainDomain/keychain-backup.plist" "/Users/satishb3/
Library/Application Support/MobileSync/Backup/
6c1b7aca59e2eba6f4635cfe7c4b2de1bd812898_extract/
Manifest.plist"
Once completed, the script extracts generic passwords, Internet passwords, and certific-
ates and private keys from the keychain, and displays them in a table.
iPhone Password Breaker
iPhone Password Breaker is a GPU-accelerated commercial tool from Elcomsoft deve-
loped for the Windows platform. The tool can decrypt the encrypted backup file when the
backup password is not available. The tool provides an option to launch a password brute-
force attack on the encrypted backup if the backup password is not available. iPhone Pass-
word Breaker tries to recover the plain-text password that protects the encrypted backup
using dictionary and brute force attacks. Passwords, which are relatively short and simple,
can be recovered in a reasonable time. But if the backup is protected with a strong and
complex password, breaking it can take forever.
To brute force the backup password, perform the following steps:
1. Launch the iPhone Password Breaker tool and the tool's main screen will appear,
as shown in the following screenshot.
2. Navigate to File | Open | Backup . A list of available device backups is displayed
and a lock symbol is shown next to the encrypted device backups, as shown in the
following screenshot:
Search WWH ::




Custom Search