1
I allegedly had a success:
>Session..........: hashcat >Status...........: Cracked >Hash.Mode........: 14800 (iTunes backup >= 10.0) >Hash.Target......: $itunes_backup$10f78b0ddf7b8e9347387249dd79098b10...5e6f00 >Time.Started.....: Sun Jan 15 10:12:21 2023 (11 secs) >Time.Estimated...: Sun Jan 15 10:12:32 2023 (0 secs) >Kernel.Feature...: Pure Kernel >Guess.Base.......: File (dictionary.txt) >Guess.Queue......: 1/1 (100.00%) >Speed.#2.........: 0 H/s (0.09ms) @ Accel:512 Loops:128 Thr:1 Vec:4 >Recovered........: 1/1 (100.00%) Digests (total), 1/1 (100.00%) Digests (new) >Progress.........: 4/4 (100.00%) >Rejected.........: 0/4 (0.00%) >Restore.Point....: 0/4 (0.00%) >Restore.Sub.#2...: Salt:0 Amplifier:0-1 Iteration:9984-9999 >Candidate.Engine.: Device Generator >Candidates.#2....: [redacted] -> [redacted]
But when tried to restore that backup, after wiping the phone it gives a "backup password incorrect" error. Based on the last line... my password should work?!
I don't understand how this is possible. I have the password carefully written down, noting upper and lowercase, on paper. I even put it in with a few others in case I was misremembering and used a computer program to verify yes, I have the right password. But the Apple software is refusing to decrypt despite having the correct password.
For context, I have encrypted backups on, and this is the decryption key.
Does anyone have any ideas on how I can access these files? (Maybe a CLI method so I can know I'm not fat fingering?)
I am really disappointed that I purchased this hardware in good faith, and apparently cannot recover my files... obviously it's hard to be 100% certain but appears I'm not fat fingering...
(I had some kind of software issue, and woke up one morning to my phone in the factory default state -- I don't know if that was a hack, or just a crash, but I can't seem to restore at all even w/ a known good backup and the recovery key)
I have over four years of notes and photography, dating back to the purchase of my phone on this device. I'd really like to retreive this data, and it will break my heart if for reasons I cannot comprehend I am simply... not allowed?
Can anyone help me understand why I am having this error and how to move past it?
[1] https://medium.com/taptuit/breaking-into-encrypted-iphone-backups-4dacc39403f0