Recovering Data From An Old Encrypted Time Machine Backup

Recovering data from a backup should be an easy thing to do. At least this is what you expect. Yesterday I had a problem which should have been easy to solve, but it was not. I hope this blog post can help others who face the same problem.

The problem

1. I had an encrypted Time Machine backup which was not used for months
2. This backup was not on an official Apple Time Capsule or on a USB HDD, but on a WD MyCloud NAS
3. I needed files from this backup
4. After running out of time I only had SSH access to the macOS, no GUI

The struggle

By default, Time Machine is one of the best and easiest backup solution I have seen. As long as you stick to the default use case, where you have one active backup disk, life is pink and happy. But this was not my case.

As always, I started to Google what shall I do. One of the first options recommended that I add the backup disk to Time Machine, and it will automagically show the backup snapshots from the old backup. Instead of this, it did not show the old snapshots but started to create a new backup. Panic button has been pressed, backup canceled, back to Google.

Other tutorials recommend to click on the Time Machine icon and pressing alt (Option) key, where I can choose "Browse other backup disks". But this did not list the old Time Machine backup. It did list the backup when selecting disks in Time Machine preferences, but I already tried and failed that way.

YAT (yet another tutorial) recommended to SSH into the NAS, and browse the backup disk, as it is just a simple directory where I can see all the files. But all the files inside where just a bunch of nonsense, no real directory structure.

YAT (yet another tutorial) recommended that I can just easily browse the content of the backup from the Finder by double-clicking on the sparse bundle file. After clicking on it, I can see the disk image on the left part of the Finder, attached as a new disk.
Well, this is true, but because of some bug, when you connect to the Time Capsule, you don't see the sparse bundle file. And I got inconsistent results, for the WD NAS, double-clicking on the sparse bundle did nothing. For the Time Capsule, it did work.
At this point, I had to leave the location where the backup was present, and I only had remote SSH access. You know, if you can't solve a problem, let's complicate things by restrict yourself in solutions.

Finally, I tried to check out some data forensics blogs, and besides some expensive tools, I could find the solution.

The solution

Finally, a blog post provided the real solution - hdiutil.
The best part of hdiutil is that you can provide the read-only flag to it. This can be very awesome when it comes to forensics acquisition.

To mount any NAS via SMB:

mount_smbfs afp://<username>@<NAS_IP>/<Share_for_backup> /<mountpoint>

To mount a Time Capsule share via AFP:

mount_afp afp://any_username:password@<Time_Capsule_IP>/<Share_for_backup> /<mountpoint>

And finally this command should do the job:

hdiutil attach test.sparsebundle -readonly

It is nice that you can provide read-only parameter.

If the backup was encrypted and you don't want to provide the password in a password prompt, use the following:

printf '%s' 'CorrectHorseBatteryStaple' | hdiutil attach test.sparsebundle -stdinpass -readonly

Note: if you receive the error "resource temporarily unavailable", probably another machine is backing up to the device

And now, you can find your backup disk under /Volumes. Happy restoring!

Probably it would have been quicker to either enable the remote GUI, or to physically travel to the system and login locally, but that would spoil the fun.Continue reading

1. Pentest Tools Open Source
2. Nsa Hack Tools Download
3. Android Hack Tools Github
4. Hacker Tools Apk
5. What Are Hacking Tools
6. Hacking Tools Software
7. Pentest Tools Find Subdomains
8. New Hacker Tools
9. Hack Rom Tools
10. Pentest Tools Subdomain
11. Hacking Tools Mac
12. Pentest Tools Tcp Port Scanner
13. Pentest Tools For Mac
14. Black Hat Hacker Tools
15. Free Pentest Tools For Windows
16. Pentest Tools Android
17. Pentest Tools List
18. Pentest Tools Windows
19. Usb Pentest Tools
20. Pentest Tools Bluekeep
21. Pentest Tools Alternative
22. Hack Tool Apk
23. Hacking Tools For Windows
24. Easy Hack Tools
25. Hacking Tools 2019
26. Hacker Tools Online
27. Hacker Tool Kit
28. Hacking Tools 2020
29. Pentest Tools Bluekeep
30. Hacker Tools For Pc
31. New Hacker Tools
32. Pentest Tools Linux
33. Best Hacking Tools 2019
34. Hacking Tools 2020
35. Blackhat Hacker Tools
36. Hack Tools For Ubuntu
37. Hacker Tools Online
38. Hack Tools For Games
39. Hacking Tools Usb
40. Hacker Tool Kit
41. Bluetooth Hacking Tools Kali
42. Termux Hacking Tools 2019
43. Tools For Hacker
44. Pentest Tools Free
45. Pentest Tools Linux
46. Hak5 Tools
47. Hacking Tools 2019
48. Hack Tools Github
49. Termux Hacking Tools 2019
50. Hacker Tools For Mac
51. Install Pentest Tools Ubuntu
52. Hacker Techniques Tools And Incident Handling
53. Termux Hacking Tools 2019
54. Android Hack Tools Github
55. Pentest Tools Apk
56. Hack Tools Online
57. Hacker Tools Windows
58. Pentest Reporting Tools
59. Pentest Tools Open Source
60. Growth Hacker Tools
61. Hack Tool Apk No Root
62. Hacker Security Tools
63. Pentest Tools Windows
64. Hacker Search Tools
65. Hackers Toolbox
66. Easy Hack Tools
67. Hacker Tools Software
68. Beginner Hacker Tools
69. Nsa Hacker Tools
70. Install Pentest Tools Ubuntu
71. Hacking Tools Kit
72. Free Pentest Tools For Windows
73. Hacking Apps
74. Hack Website Online Tool
75. Kik Hack Tools
76. Pentest Tools Nmap
77. Hacker Tools Github
78. Pentest Box Tools Download
79. Tools 4 Hack
80. Hack Tools
81. Physical Pentest Tools
82. Best Pentesting Tools 2018
83. Android Hack Tools Github
84. Hack Tools Download
85. Game Hacking