Recovering Data From An Old Encrypted Time Machine Backup

Recovering data from a backup should be an easy thing to do. At least this is what you expect. Yesterday I had a problem which should have been easy to solve, but it was not. I hope this blog post can help others who face the same problem.

The problem

1. I had an encrypted Time Machine backup which was not used for months
2. This backup was not on an official Apple Time Capsule or on a USB HDD, but on a WD MyCloud NAS
3. I needed files from this backup
4. After running out of time I only had SSH access to the macOS, no GUI

The struggle

By default, Time Machine is one of the best and easiest backup solution I have seen. As long as you stick to the default use case, where you have one active backup disk, life is pink and happy. But this was not my case.

As always, I started to Google what shall I do. One of the first options recommended that I add the backup disk to Time Machine, and it will automagically show the backup snapshots from the old backup. Instead of this, it did not show the old snapshots but started to create a new backup. Panic button has been pressed, backup canceled, back to Google.

Other tutorials recommend to click on the Time Machine icon and pressing alt (Option) key, where I can choose "Browse other backup disks". But this did not list the old Time Machine backup. It did list the backup when selecting disks in Time Machine preferences, but I already tried and failed that way.

YAT (yet another tutorial) recommended to SSH into the NAS, and browse the backup disk, as it is just a simple directory where I can see all the files. But all the files inside where just a bunch of nonsense, no real directory structure.

YAT (yet another tutorial) recommended that I can just easily browse the content of the backup from the Finder by double-clicking on the sparse bundle file. After clicking on it, I can see the disk image on the left part of the Finder, attached as a new disk.
Well, this is true, but because of some bug, when you connect to the Time Capsule, you don't see the sparse bundle file. And I got inconsistent results, for the WD NAS, double-clicking on the sparse bundle did nothing. For the Time Capsule, it did work.
At this point, I had to leave the location where the backup was present, and I only had remote SSH access. You know, if you can't solve a problem, let's complicate things by restrict yourself in solutions.

Finally, I tried to check out some data forensics blogs, and besides some expensive tools, I could find the solution.

The solution

Finally, a blog post provided the real solution - hdiutil.
The best part of hdiutil is that you can provide the read-only flag to it. This can be very awesome when it comes to forensics acquisition.

To mount any NAS via SMB:

mount_smbfs afp://<username>@<NAS_IP>/<Share_for_backup> /<mountpoint>

To mount a Time Capsule share via AFP:

mount_afp afp://any_username:password@<Time_Capsule_IP>/<Share_for_backup> /<mountpoint>

And finally this command should do the job:

hdiutil attach test.sparsebundle -readonly

It is nice that you can provide read-only parameter.

If the backup was encrypted and you don't want to provide the password in a password prompt, use the following:

printf '%s' 'CorrectHorseBatteryStaple' | hdiutil attach test.sparsebundle -stdinpass -readonly

Note: if you receive the error "resource temporarily unavailable", probably another machine is backing up to the device

And now, you can find your backup disk under /Volumes. Happy restoring!

Probably it would have been quicker to either enable the remote GUI, or to physically travel to the system and login locally, but that would spoil the fun.Related articles

1. Best Hacking Tools 2019
2. Hack Tools 2019
3. Hacker Tools For Pc
4. Hack App
5. Hak5 Tools
6. Hacking Tools For Windows Free Download
7. Hacking App
8. Hacking Tools Pc
9. Hacker Tools List
10. Pentest Tools Find Subdomains
11. Hacker Techniques Tools And Incident Handling
12. Hacker Tools Github
13. Hacking Tools Name
14. Hacker Tools
15. Hacking Tools Kit
16. Hacking Tools For Windows 7
17. Easy Hack Tools
18. Hacking Apps
19. Hack Tools 2019
20. Hacker Tools
21. Hacking Tools Software
22. Pentest Tools Online
23. Pentest Tools For Android
24. What Are Hacking Tools
25. Pentest Tools Windows
26. Hack And Tools
27. Pentest Tools Port Scanner
28. Hacker Tools For Pc
29. Hacker Tools Hardware
30. Hacking Tools 2019
31. Hack Tools Pc
32. Hacking Tools For Mac
33. Pentest Tools Windows
34. Hacking App
35. Pentest Tools Review
36. How To Make Hacking Tools
37. Pentest Tools Windows
38. Hacker Tools Mac
39. What Are Hacking Tools
40. Hacker Search Tools
41. Hackers Toolbox
42. Pentest Tools Apk
43. Hacking Tools For Mac
44. Hack Tools For Pc
45. How To Install Pentest Tools In Ubuntu
46. Hacking Tools Kit
47. Hacking Tools Download
48. Kik Hack Tools
49. Hacking Tools For Beginners
50. Hack Tools Github
51. How To Install Pentest Tools In Ubuntu
52. Hacker Tools Online
53. Pentest Tools Github
54. Hacker Tools Apk
55. Hak5 Tools
56. Pentest Automation Tools
57. Pentest Tools Nmap
58. Best Hacking Tools 2019
59. Best Pentesting Tools 2018
60. Hacking Tools Kit
61. Pentest Tools Apk
62. Github Hacking Tools
63. Kik Hack Tools
64. Pentest Tools Port Scanner
65. Hacking Tools For Windows
66. Hacking Tools For Mac
67. Hack Tool Apk No Root
68. Nsa Hack Tools
69. Hack Tools Download
70. Hacking Tools
71. Hacker Tools Free Download
72. Free Pentest Tools For Windows
73. Wifi Hacker Tools For Windows
74. New Hack Tools
75. Hacking Tools Mac
76. Hacker Tool Kit
77. Hack Tool Apk No Root
78. Hack Tools For Games
79. Pentest Reporting Tools
80. Hacking App
81. What Are Hacking Tools
82. Hacking Tools Pc
83. Nsa Hack Tools Download
84. Pentest Tools Find Subdomains
85. Hacking Tools Download
86. Hacker Tools
87. How To Install Pentest Tools In Ubuntu
88. Pentest Tools Website Vulnerability
89. Pentest Tools Framework
90. Hack Tools
91. How To Install Pentest Tools In Ubuntu
92. Pentest Reporting Tools
93. Hackrf Tools
94. How To Make Hacking Tools
95. Github Hacking Tools
96. Black Hat Hacker Tools
97. Pentest Tools Review
98. Hacking Tools For Windows
99. Pentest Tools Website
100. Hacker Tools For Windows
101. Hacking Tools For Games
102. Hacker Tools For Windows
103. Hacking Tools For Windows
104. Pentest Tools Website Vulnerability
105. Beginner Hacker Tools
106. Hacker Tools Apk
107. Pentest Tools Subdomain
108. Hack Tools For Mac
109. Hack Apps
110. Best Hacking Tools 2020
111. Hacking Tools Hardware
112. How To Hack
113. Pentest Box Tools Download
114. Hacking Tools For Kali Linux
115. Hack Tool Apk
116. Pentest Tools List
117. Hacker
118. Hacking App
119. Pentest Tools Tcp Port Scanner
120. Pentest Box Tools Download
121. Pentest Tools Nmap