#DECRYPT KEYCHAIN.PLIST HOW TO#
#DECRYPT KEYCHAIN.PLIST INSTALL#
#DECRYPT KEYCHAIN.PLIST ANDROID#
#DECRYPT KEYCHAIN.PLIST PASSWORD#

We mainly care about both of the Manifest files. Each sub-folder is a backup and contains a bunch of additional subfolders along with the following 4 important files: This folder contains sub-folders with unique device identifiers. Exploring iOS backupīy default, when you create an iOS backup on Mac (Catalina in my case), it is stored under ~/Library/Application Support/MobileSync/Backup/.

#DECRYPT KEYCHAIN.PLIST ANDROID#

It would be doubly awesome if I can move the messages to an Android device but, as I mentioned before, that wasn’t my main aim. My target was to have a local copy of WhatsApp messages that I can read and search through locally. This was mostly a learning exercise for me regarding how Apple stores iOS backups and how I can selectively extract information and data from one. I don’t have any immediate plans for switching (if ever) but it seemed like a fun challenge and so I started surveying the available tools and how they work. I just don’t want to lose all of the important information I have in my chats. I don’t really care if I can import the messages in WhatsApp. I wanted to make sure that if I switched again from iOS to Android I don’t lose any messages. I switched from Android to iOS in the past and lost all of my WhatsApp messages.

#DECRYPT KEYCHAIN.PLIST HOW TO#

Hi everyone! 👋 I was recently exploring how to get a local backup of WhatsApp messages from my iPhone.

#DECRYPT KEYCHAIN.PLIST PASSWORD#

sparsebundle, give the password we dug out of the keyfile, and continue as usual.Extracting WhatsApp messages from an iOS backup April 24, 2022 Now we can simply use the Finder to open the Time Machine. For my use case, I wanted the Time Machine password, and this will be represented in the output as a Generic password record named Time Machine. You'll see the plaintext password of everything in the system keychain. Python chainbreaker.py -f /path/to/system.keychain -k (the byte string from step 1) Now we simply give chainbreaker the key you just found and the file: Run the following commands on the target machine:

#DECRYPT KEYCHAIN.PLIST INSTALL#

You'll need to install the hexdump library for Python. That tool will be Chainbreaker - a python script.

We're going on the assumption that the dead Mac can't be booted in such a way that we can use its Keychain Access app normally. Step 2: Dump the keychain using the password

This is the decryption key for the keychain. The & echo is so we get a single newline afterward so the output doesn't run into the beginning of your shell prompt after the command finishes.Ĭopy this string aside. Hexdump -s 8 -n 24 -e '1/1 '%.2x'' /path/to/SystemKey & echoĮxplained: Skip the first 8 bytes from the beginning of the file, continue 24 bytes after that, and use the format string to dump the data out on one line (it's a C-style printf string, if you're curious). The proper command to get the right hex key is: Even better, we need 24 bytes out of the middle of the file - after the magic number that indicates a key file, but before the checksum bytes. We can't use SystemKey as is - it contains random bytes that can't be entered into a password dialog or command line. Step 1: Recovering the encryption key for the source keychain

The SystemKey file from the source machine.

This file is located in either /System/Library/Keychains or /Library/Keychains.

The System.keychain file from the source machine. One new Mac or Linux machine (called the Target machine from here on)

One dead Mac with a readable filesystem (called the Source machine from here on).

Decrypt Keychain.Plist