MacOS – How to access a FileVault-encrypted home directory with forgotten password

filevaultkeychainmacospasswordsparsebundle

For ease of the reader, the short version:

MacBook Pro running Mountain Lion. A user has forgotten his FileVault password and master recovery code. FileVault 2 is not enabled, just the user's home directory is encrypted and exists as a sparsebundle. I would crack the sparsebundle but I'm having troubles getting the hash. All I really want/need to do is be able to decode the user folder so that its data can be accessed again.

BTW, I saw somewhere that you can have apple reset the FileVault password using your Apple ID? Is this true when FileVault 2 full-disc encryption is not enabled?


The long version:

This involves a Macbook Pro running Mountain Lion where the user changed their user password and cannot remember either the original password, nor the password it was changed to. All that they remember about the passwords were that they were not real words, as they were acronyms of the first letter of every word in a sentence (which he doesn't remember either), lower and uppercase and likely contained some symbols. It could be anywhere from 4-9 characters long. To regain access to the computer, I booted in single-user mode and made myself an admin account, then used that account to change the original user's login password.
Now when the original user logs in with the new password, he is told that his filevault password is not his login password and that he needs to enter the old password before he can even login.
Problem is, of course, he doesn't remember it. No does he know the filevault master recovery code.

Here's what I think I know so far:
It would be useless to crack the user password, since it's already known. I'm still kinda iffy on keychains, but they only store the current password, correct? Previous user login passwords are not stored anywhere, are they?

Speaking of keychains, I have both the public and private keys for the master filevault keychain. Is there anything I can do with these to unlock the filevault master keychain without knowing the filevault password?
Or can I somehow use these to decode the sparsebundle?

The Macbook Pro is running OSX Mountain Lion but filevault 2 is NOT enabled, just the user folder is encrypted and exists as a sparsebundle. I changed permissions so that I could access the sparsebundle… from what I understand I could either try cracking the master.filevault keychain or the sparsebundle itself. From something I read, I am led to believe that the sparsebundle's hash might be unsalted because it's an upgraded Mac? I assume that meant because it was calculated in an older version of OSX that didn't salt the hashes, but I don't really know.

With regards to the master.filevault keychain, the hash is in plaintext, surrounded by zeros, correct? It doesn't really matter I suppose, as trying to crack it would likely be too difficult since I'd have to just brute force it with upper and lower case letters, symbols and 4-9 characters. I have a forensic computer with 3xATI video cards ready and waiting, but it said something like 320,000 years. (Side question: is it possible to use a dictionary list as words that the password will NOT be? The password here, if you remember, was the first letter of every word of some phrase so it's definitely NOT an english word or a variant of one.)

So, I guess I'm gonna give cracking the sparseimage bundle a try; can anyone tell me how to get the hash for it? Is it really in /private/var/db/shadow under the user's GUID? Is this the hash of the filevault password for the user, or just of the user's login password? What I read was somewhat unclear on that point and the directions on how to pull the hash from the GUID file were kinda confusing.

What I'm asking, I suppose, is if anyone can help me; all I really want/need to do is be able to decode the user folder so that its data can be accessed again. Whether this is by unlocking the filevault.master keychain, somehow using the private key and certificate of the filevault.master keychain to bestow access, cracking the sparsebundle image's password or whatever else, I don't care. If you know how I can get it done, I'm all ears.

BTW, I saw somewhere that you can have apple reset the filevault password using your Apple ID? Is this only for filevault 2 whole disk encryption, or does it apply to all files/folders encoded with filevault? Does it only work on Maverick? I'd love for this to be true, since his Apple ID is perhaps the ONLY password he actually remembers.

Any help would be welcomed- thanks in advance for the answer 😉

Best Answer

If you can unlock the FileVaultMaster.keychain, you may be able to recover the user's data from the encrypted disk image. I have a guide available from here in PDF format:

https://app.box.com/s/g3z57u54xc3fz6sr1tfn

The section you'll want to reference is the Command-line FileVault Recovery part of the Section VII: Troubleshooting FileVault documentation. That section covers troubleshooting and data recovery for legacy FileVault.