Wednesday, August 26, 2020

Recovering Data From An Old Encrypted Time Machine Backup

Recovering data from a backup should be an easy thing to do. At least this is what you expect. Yesterday I had a problem which should have been easy to solve, but it was not. I hope this blog post can help others who face the same problem.

The problem

1. I had an encrypted Time Machine backup which was not used for months
2. This backup was not on an official Apple Time Capsule or on a USB HDD, but on a WD MyCloud NAS
3. I needed files from this backup
4. After running out of time I only had SSH access to the macOS, no GUI

The struggle

By default, Time Machine is one of the best and easiest backup solution I have seen. As long as you stick to the default use case, where you have one active backup disk, life is pink and happy. But this was not my case.

As always, I started to Google what shall I do. One of the first options recommended that I add the backup disk to Time Machine, and it will automagically show the backup snapshots from the old backup. Instead of this, it did not show the old snapshots but started to create a new backup. Panic button has been pressed, backup canceled, back to Google.

Other tutorials recommend to click on the Time Machine icon and pressing alt (Option) key, where I can choose "Browse other backup disks". But this did not list the old Time Machine backup. It did list the backup when selecting disks in Time Machine preferences, but I already tried and failed that way.

YAT (yet another tutorial) recommended to SSH into the NAS, and browse the backup disk, as it is just a simple directory where I can see all the files. But all the files inside where just a bunch of nonsense, no real directory structure.

YAT (yet another tutorial) recommended that I can just easily browse the content of the backup from the Finder by double-clicking on the sparse bundle file. After clicking on it, I can see the disk image on the left part of the Finder, attached as a new disk.
Well, this is true, but because of some bug, when you connect to the Time Capsule, you don't see the sparse bundle file. And I got inconsistent results, for the WD NAS, double-clicking on the sparse bundle did nothing. For the Time Capsule, it did work.
At this point, I had to leave the location where the backup was present, and I only had remote SSH access. You know, if you can't solve a problem, let's complicate things by restrict yourself in solutions.

Finally, I tried to check out some data forensics blogs, and besides some expensive tools, I could find the solution.

The solution

Finally, a blog post provided the real solution - hdiutil.
The best part of hdiutil is that you can provide the read-only flag to it. This can be very awesome when it comes to forensics acquisition.

To mount any NAS via SMB:
mount_smbfs afp://<username>@<NAS_IP>/<Share_for_backup> /<mountpoint>

To mount a Time Capsule share via AFP:
mount_afp afp://any_username:password@<Time_Capsule_IP>/<Share_for_backup> /<mountpoint>

And finally this command should do the job:
hdiutil attach test.sparsebundle -readonly

It is nice that you can provide read-only parameter.

If the backup was encrypted and you don't want to provide the password in a password prompt, use the following:
printf '%s' 'CorrectHorseBatteryStaple' | hdiutil attach test.sparsebundle -stdinpass -readonly

Note: if you receive the error "resource temporarily unavailable", probably another machine is backing up to the device

And now, you can find your backup disk under /Volumes. Happy restoring!

Probably it would have been quicker to either enable the remote GUI, or to physically travel to the system and login locally, but that would spoil the fun.

Read more

  1. Hack Tools For Ubuntu
  2. Hacker Tools Apk
  3. Hacking App
  4. Pentest Tools For Ubuntu
  5. Pentest Recon Tools
  6. Hacking Tools Free Download
  7. Hacking Tools For Windows
  8. Hacking Tools Hardware
  9. Hacker Tools For Pc
  10. Hack Tools Online
  11. Hacker Tools Mac
  12. Hacker Tools Online
  13. Hack Tools Pc
  14. Pentest Tools Website
  15. Pentest Tools Review
  16. Hacks And Tools
  17. Pentest Recon Tools
  18. Pentest Tools List
  19. Hack Tools
  20. Pentest Tools Find Subdomains
  21. World No 1 Hacker Software
  22. Hackers Toolbox
  23. Pentest Tools For Ubuntu
  24. Hacker Tools For Pc
  25. Tools Used For Hacking
  26. Hacking Tools Github
  27. Hacking Tools Download
  28. Pentest Reporting Tools
  29. Hack Tools For Games
  30. Hacker Tools 2019
  31. Hacker Tools Hardware
  32. How To Hack
  33. Hack Rom Tools
  34. Hacker Tools
  35. Pentest Tools For Mac
  36. Best Hacking Tools 2020
  37. What Are Hacking Tools
  38. Hacking Apps
  39. Hacking Tools And Software
  40. Pentest Tools Apk
  41. Hacking Tools Windows 10
  42. Pentest Tools Open Source
  43. Pentest Tools Website Vulnerability
  44. Hack Tools For Windows
  45. Pentest Tools Nmap
  46. Hacker Tools Hardware
  47. Pentest Tools Github
  48. Hacking Tools For Beginners
  49. Hack App
  50. Hack Rom Tools
  51. Hacker Tools 2020
  52. Hacker Tools Github
  53. Hacker Tools Linux
  54. Hacker Tool Kit
  55. Pentest Tools Kali Linux
  56. Hacker Tools For Pc
  57. Hacking Tools Windows
  58. Pentest Tools For Ubuntu
  59. New Hacker Tools
  60. Pentest Automation Tools
  61. Pentest Tools Website Vulnerability
  62. Hacking Tools Software
  63. Pentest Tools Online
  64. Pentest Tools Linux
  65. Hacking Tools Hardware
  66. Hacking Tools Download
  67. Hacker Tools For Windows
  68. Hack Tools Online
  69. How To Hack
  70. Hacker Tools Hardware
  71. Hacking Tools And Software
  72. Hacker Tools
  73. Nsa Hacker Tools
  74. What Is Hacking Tools
  75. Hacker Tools Github
  76. Hacking Tools Pc
  77. Tools Used For Hacking
  78. Hacker Search Tools
  79. Hacker Tools Software
  80. Pentest Tools Find Subdomains
  81. Pentest Tools For Mac
  82. Blackhat Hacker Tools
  83. Hacking Tools Name
  84. Hacking Tools Online
  85. Pentest Tools Free
  86. Usb Pentest Tools
  87. Pentest Tools Linux
  88. Nsa Hack Tools
  89. Hacking Tools Online
  90. Hack And Tools
  91. Hack Tools 2019
  92. Hacking Tools For Pc
  93. Pentest Reporting Tools
  94. Kik Hack Tools
  95. Pentest Tools Android
  96. Hacker Tools Free Download
  97. Hacker Tools Online
  98. Hacker Tools 2020
  99. Github Hacking Tools
  100. Hack Tools For Pc
  101. Hack Tools
  102. Best Hacking Tools 2019


Post a Comment


Twitter Delicious Facebook Digg Stumbleupon Favorites