Disk Utility – Managing Encrypted DMG Passwords and Keychain in OS X 10.11

CrowBar is somewhat out-of-date.

Probably the most comprehensive and up-to-date free password-recovery package is JohnTheRipper. Among many other formats, it can test .dmg's as well.

Note that JtR does not "break" the encryption, it just automates and speeds the process of trying thousands (or millions, or trillions) of dictionary-based and random passwords in hopes of eventually hitting the correct one that decrypts your data.

JohnTheRipper is a command-line tool and requires one to be pretty well-versed in standard shell syntax, etc.

If you don't want to compile JtR yourself, there are also free unofficial pre-compiled Mac OS X binaries available.

The latest "jumbo" and "magnum" community-contributed versions can handle .dmg files, sparse-images through OS X 10.7. If you dig around in the recent patches you can even find code to handle OS X 10.8 passwords.

If you encrypt something once, you can't weaken it by encrypting it another time. You can strengthen it, but not very much that it makes a big difference. Most attacks are brute force password Crack attacks, on both filevault and the disk image, because there is the highest chance for the decrypter to win. So you harden the step of decryption because you encrypt twice, but you don't harden it much. but btw, best anti brute force tactics are using algorithms like PBKDEF2 instead of simple SHA. but that's something only apple can do. and I expect from them to do something like that.