IPhone – View Keychain from encrypted IOS 8.2 backup

backupiphonekeychain

Is there any way to access the keychain from an Iphone 5 IOS 8.2 backup?

Here are the hard facts:

  • encrypted backup where I KNOW the password
  • device is lost

So far I could restore all the (important) files just fine, however I am stuck on how to view my saved passwords. Apple support sites only show me how to restore a backup, but not how to read it. After searching for quite some time
I found two possibilities:

  1. Decrypting the iPhone keychain from backups

This requires me to have not only any iPhone (like the Apple support pages) but even the original one, which I have the backup of. So that's not possible.

  1. Elcomsoft Phone Breaker

This seems to work. I downloaded the demo version, which shows which passwords are saved on the backups, but not what they are. However, the cheapest version for OS X is 199€.

Isn't there any other way to access my data for free?

Best Answer

I had the same problem and found a great article that helped me decrypt the keychain from my iOS 9 backup: Recovering Google Authenticator Keys from iOS Backups.

Here are the steps for El Capitan:

  • Install pip: sudo easy_install pip

  • Install m2crypto (see answer to Trouble installing m2crypto with pip on El Capitan)

    • First, install openssl and swig with Homebrew: brew install openssl swig

    • Then install m2crypto using pip:

      env LDFLAGS="-L$(brew --prefix openssl)/lib" \
CFLAGS="-I$(brew --prefix openssl)/include" \
SWIG_FEATURES="-cpperraswarn -includeall -I$(brew --prefix openssl)/include" \
pip install --user m2crypto

  • Install some more Python packages: 

    pip install --user construct progressbar pycrypto pyasn1
  • Download the iPhone Data Protection Tools
  • Extract your backup: python backup_tool.py PATH_TO_BACKUP

  • And finally, decrypt your keychain:

    python keychain_tool.py -d "PATH_TO_extract/KeychainDomain/keychain-backup.plist" "PATH_TO_extract/Manifest.plist"
Related Question