Recovering Data From An Old Encrypted Time Machine Backup

Recovering data from a backup should be an easy thing to do. At least this is what you expect. Yesterday I had a problem which should have been easy to solve, but it was not. I hope this blog post can help others who face the same problem.

The problem

1. I had an encrypted Time Machine backup which was not used for months
2. This backup was not on an official Apple Time Capsule or on a USB HDD, but on a WD MyCloud NAS
3. I needed files from this backup
4. After running out of time I only had SSH access to the macOS, no GUI

The struggle

By default, Time Machine is one of the best and easiest backup solution I have seen. As long as you stick to the default use case, where you have one active backup disk, life is pink and happy. But this was not my case.

As always, I started to Google what shall I do. One of the first options recommended that I add the backup disk to Time Machine, and it will automagically show the backup snapshots from the old backup. Instead of this, it did not show the old snapshots but started to create a new backup. Panic button has been pressed, backup canceled, back to Google.

Other tutorials recommend to click on the Time Machine icon and pressing alt (Option) key, where I can choose "Browse other backup disks". But this did not list the old Time Machine backup. It did list the backup when selecting disks in Time Machine preferences, but I already tried and failed that way.

YAT (yet another tutorial) recommended to SSH into the NAS, and browse the backup disk, as it is just a simple directory where I can see all the files. But all the files inside where just a bunch of nonsense, no real directory structure.

YAT (yet another tutorial) recommended that I can just easily browse the content of the backup from the Finder by double-clicking on the sparse bundle file. After clicking on it, I can see the disk image on the left part of the Finder, attached as a new disk.
Well, this is true, but because of some bug, when you connect to the Time Capsule, you don't see the sparse bundle file. And I got inconsistent results, for the WD NAS, double-clicking on the sparse bundle did nothing. For the Time Capsule, it did work.
At this point, I had to leave the location where the backup was present, and I only had remote SSH access. You know, if you can't solve a problem, let's complicate things by restrict yourself in solutions.

Finally, I tried to check out some data forensics blogs, and besides some expensive tools, I could find the solution.

The solution

Finally, a blog post provided the real solution - hdiutil.
The best part of hdiutil is that you can provide the read-only flag to it. This can be very awesome when it comes to forensics acquisition.

To mount any NAS via SMB:

mount_smbfs afp://<username>@<NAS_IP>/<Share_for_backup> /<mountpoint>

To mount a Time Capsule share via AFP:

mount_afp afp://any_username:password@<Time_Capsule_IP>/<Share_for_backup> /<mountpoint>

And finally this command should do the job:

hdiutil attach test.sparsebundle -readonly

It is nice that you can provide read-only parameter.

If the backup was encrypted and you don't want to provide the password in a password prompt, use the following:

printf '%s' 'CorrectHorseBatteryStaple' | hdiutil attach test.sparsebundle -stdinpass -readonly

Note: if you receive the error "resource temporarily unavailable", probably another machine is backing up to the device

And now, you can find your backup disk under /Volumes. Happy restoring!

Probably it would have been quicker to either enable the remote GUI, or to physically travel to the system and login locally, but that would spoil the fun.

Continue reading

1. Hacker Tools For Pc
2. Hacking Tools For Windows Free Download
3. Hacking Tools For Beginners
4. Hacker Tools Mac
5. Hacking Tools For Kali Linux
6. Hacking Tools Free Download
7. Pentest Tools Framework
8. Tools 4 Hack
9. Hack Tool Apk
10. Install Pentest Tools Ubuntu
11. Hacker Techniques Tools And Incident Handling
12. Hack Tools 2019
13. Hacking Tools Free Download
14. Hacking Tools For Games
15. Blackhat Hacker Tools
16. Pentest Tools Tcp Port Scanner
17. Hacker Tools Apk Download
18. Hacker Tools Mac
19. How To Install Pentest Tools In Ubuntu
20. Game Hacking
21. Physical Pentest Tools
22. Hacking Tools Name
23. Hack Apps
24. Hacking Tools Kit
25. Hack Tools For Windows
26. Hacking Tools 2020
27. Hack Tools For Mac
28. Hacker Tools Online
29. Hack Website Online Tool
30. Hacking Tools For Windows 7
31. Hackers Toolbox
32. Hacker Tools Windows
33. Hack Tools Mac
34. Hack And Tools
35. Pentest Tools Online
36. Wifi Hacker Tools For Windows
37. Pentest Tools Nmap
38. Hacking Tools Usb
39. World No 1 Hacker Software
40. Hacking Tools And Software
41. Pentest Tools Github
42. Free Pentest Tools For Windows
43. Growth Hacker Tools
44. Pentest Automation Tools
45. Nsa Hacker Tools
46. Best Hacking Tools 2019
47. Pentest Tools Apk
48. Github Hacking Tools
49. Nsa Hacker Tools
50. Pentest Tools Framework
51. Hacking App
52. Hacker Tools Mac
53. Hacker Tools Apk
54. Install Pentest Tools Ubuntu
55. Hacker Tools Github
56. Hacker Tool Kit
57. Pentest Tools For Ubuntu
58. Pentest Tools Linux
59. Hack Tools Github
60. Hacking Tools For Mac
61. Pentest Tools Kali Linux
62. Hacking Tools For Windows 7
63. Hackers Toolbox
64. Hacker Tools For Windows
65. Hack Tools For Games
66. Hacker Tools 2019
67. Hacker Hardware Tools
68. Hack And Tools
69. Hack Rom Tools
70. Pentest Tools Bluekeep
71. Hacking Tools For Windows 7
72. Hackrf Tools
73. Hacker Tools
74. Hacker Tools Free Download
75. Hacking Tools For Windows Free Download
76. Hack Tools Pc
77. Pentest Tools Apk
78. Hacker Tools For Ios
79. Pentest Tools Android
80. Hackers Toolbox
81. Pentest Tools For Ubuntu
82. Hack Tools For Games
83. Best Hacking Tools 2019
84. Pentest Tools Subdomain
85. Hak5 Tools
86. Hack App
87. Hack Tools For Ubuntu
88. Beginner Hacker Tools
89. Usb Pentest Tools
90. Hack Tools For Games
91. Easy Hack Tools
92. Hack Tools Github
93. Hacker Tools
94. Install Pentest Tools Ubuntu
95. Hacking Tools Pc
96. Hacker
97. Github Hacking Tools
98. Hacker Tools 2020
99. Best Hacking Tools 2019
100. Nsa Hacker Tools
101. Hack Apps
102. Pentest Tools For Ubuntu
103. Pentest Tools Online
104. Hack Tools
105. Install Pentest Tools Ubuntu
106. Hack Tools Pc
107. Hacking Tools Download
108. Hacker Tools Mac
109. Hack Tools For Games
110. Hack Tools 2019
111. Hacker Tools Apk Download
112. Hack Tools
113. Hacker Techniques Tools And Incident Handling
114. Bluetooth Hacking Tools Kali
115. Hacking Tools Software
116. Hacker Tools Github
117. Nsa Hack Tools Download
118. Computer Hacker
119. Top Pentest Tools
120. Hacker Tools Windows
121. Pentest Tools Website
122. Physical Pentest Tools
123. Hacker Tools For Pc
124. Hacking Tools Name
125. Pentest Tools For Windows
126. Pentest Tools Open Source
127. Nsa Hack Tools Download
128. Hacking Tools And Software
129. Hack Tools Github
130. Hacker Tools Apk Download
131. Pentest Tools Bluekeep
132. Pentest Tools Review
133. Pentest Tools For Ubuntu
134. Pentest Tools Online
135. Hack App
136. Pentest Tools Android
137. Hacking Tools For Kali Linux
138. Hacking Tools Windows 10
139. Tools 4 Hack
140. World No 1 Hacker Software
141. Hacking Tools 2019
142. Hacker Tools Online
143. New Hacker Tools
144. Pentest Tools Open Source
145. Hacker Tools Apk
146. Beginner Hacker Tools
147. Pentest Tools For Ubuntu
148. Hacking Tools Software
149. Hacker Hardware Tools
150. Hacking Tools Github
151. Hacker Tools For Ios
152. Top Pentest Tools
153. Hacker Tools Software
154. Hacker Tool Kit
155. Hak5 Tools
156. Pentest Tools List
157. Hacker Tools Free Download
158. Hacking Tools Windows 10
159. Pentest Tools For Mac
160. Hack Tools For Mac
161. Hacking Tools Download
162. Hack Tools For Mac
163. Pentest Tools Framework
164. Hacker Tools Apk
165. Hacking Tools Kit
166. Pentest Tools Download
167. Pentest Tools Find Subdomains
168. Pentest Automation Tools
169. How To Install Pentest Tools In Ubuntu