Ask HN: How can I restore my iPhone backup and retrieve 4 years of photos?

1 pointsgreggarious3y ago2 comments

I just used this guide[1] to crack my own backup password file.

I allegedly had a success:

>Session..........: hashcat >Status...........: Cracked >Hash.Mode........: 14800 (iTunes backup >= 10.0) >Hash.Target......: $itunes_backup$10f78b0ddf7b8e9347387249dd79098b10...5e6f00 >Time.Started.....: Sun Jan 15 10:12:21 2023 (11 secs) >Time.Estimated...: Sun Jan 15 10:12:32 2023 (0 secs) >Kernel.Feature...: Pure Kernel >Guess.Base.......: File (dictionary.txt) >Guess.Queue......: 1/1 (100.00%) >Speed.#2.........: 0 H/s (0.09ms) @ Accel:512 Loops:128 Thr:1 Vec:4 >Recovered........: 1/1 (100.00%) Digests (total), 1/1 (100.00%) Digests (new) >Progress.........: 4/4 (100.00%) >Rejected.........: 0/4 (0.00%) >Restore.Point....: 0/4 (0.00%) >Restore.Sub.#2...: Salt:0 Amplifier:0-1 Iteration:9984-9999 >Candidate.Engine.: Device Generator >Candidates.#2....: [redacted] -> [redacted]

But when tried to restore that backup, after wiping the phone it gives a "backup password incorrect" error. Based on the last line... my password should work?!

I don't understand how this is possible. I have the password carefully written down, noting upper and lowercase, on paper. I even put it in with a few others in case I was misremembering and used a computer program to verify yes, I have the right password. But the Apple software is refusing to decrypt despite having the correct password.

For context, I have encrypted backups on, and this is the decryption key.

Does anyone have any ideas on how I can access these files? (Maybe a CLI method so I can know I'm not fat fingering?)

I am really disappointed that I purchased this hardware in good faith, and apparently cannot recover my files... obviously it's hard to be 100% certain but appears I'm not fat fingering...

(I had some kind of software issue, and woke up one morning to my phone in the factory default state -- I don't know if that was a hack, or just a crash, but I can't seem to restore at all even w/ a known good backup and the recovery key)

I have over four years of notes and photography, dating back to the purchase of my phone on this device. I'd really like to retreive this data, and it will break my heart if for reasons I cannot comprehend I am simply... not allowed?

Can anyone help me understand why I am having this error and how to move past it?

[1] https://medium.com/taptuit/breaking-into-encrypted-iphone-backups-4dacc39403f0

2 comments

KiDD3y ago

Things have changed with newer OS versions. What iOS version was backed up with? What OS was the computer running? iTunes or Finder backup?

Read over https://help.apple.com/pdf/security/en_US/apple-platform-sec...

greggariousOP3y ago

It was on the most recent version of iOS at the time of the last major backup prior to the loss (Late June, 2022). So macOS Version 12: "Monterey" and iOS version 13. (So it's a backup of an iPhone, accessed via finder)

I had a look but... I didn't see anything covering this.

Just to be clear: it's a situation where hashcat goes "yup, here's the password" but typing that into finder to restore gives an error.

I'm hoping maybe there are command line tools to recreate the gui functionality that might give additional explanation why it... feels... the key is wrong.

(I hate to sound so odd, but... I feel like I'm a teenager struggling with the CLI for the first time in a very long time. I've never had something this unusual happen, and I'm struggling to understand how a tool like hashcat can say yup that's the password... then have it not be accepted.)

I'd really prefer not to post a screenshot with the key but I guess I could if that's what it takes... this is years of photos, all lost, if this key is not accepted.

To be clear, I have a dicionary file with 4 possible keys to reduce chances I was fat fingering, and it explicitly said one worked

>Session..........: hashcat

>Status...........: Cracked

[snip]

(Maybe there's a more specialized forum? I haven't had luck with Reddit for anything this advanced in the past)

j / k navigate · click thread line to collapse