Recovering Data From An Old Encrypted Time Machine Backup

Recovering data from a backup should be an easy thing to do. At least this is what you expect. Yesterday I had a problem which should have been easy to solve, but it was not. I hope this blog post can help others who face the same problem.

The problem

1. I had an encrypted Time Machine backup which was not used for months
2. This backup was not on an official Apple Time Capsule or on a USB HDD, but on a WD MyCloud NAS
3. I needed files from this backup
4. After running out of time I only had SSH access to the macOS, no GUI

The struggle

By default, Time Machine is one of the best and easiest backup solution I have seen. As long as you stick to the default use case, where you have one active backup disk, life is pink and happy. But this was not my case.

As always, I started to Google what shall I do. One of the first options recommended that I add the backup disk to Time Machine, and it will automagically show the backup snapshots from the old backup. Instead of this, it did not show the old snapshots but started to create a new backup. Panic button has been pressed, backup canceled, back to Google.

Other tutorials recommend to click on the Time Machine icon and pressing alt (Option) key, where I can choose "Browse other backup disks". But this did not list the old Time Machine backup. It did list the backup when selecting disks in Time Machine preferences, but I already tried and failed that way.

YAT (yet another tutorial) recommended to SSH into the NAS, and browse the backup disk, as it is just a simple directory where I can see all the files. But all the files inside where just a bunch of nonsense, no real directory structure.

YAT (yet another tutorial) recommended that I can just easily browse the content of the backup from the Finder by double-clicking on the sparse bundle file. After clicking on it, I can see the disk image on the left part of the Finder, attached as a new disk.
Well, this is true, but because of some bug, when you connect to the Time Capsule, you don't see the sparse bundle file. And I got inconsistent results, for the WD NAS, double-clicking on the sparse bundle did nothing. For the Time Capsule, it did work.
At this point, I had to leave the location where the backup was present, and I only had remote SSH access. You know, if you can't solve a problem, let's complicate things by restrict yourself in solutions.

Finally, I tried to check out some data forensics blogs, and besides some expensive tools, I could find the solution.

The solution

Finally, a blog post provided the real solution - hdiutil.
The best part of hdiutil is that you can provide the read-only flag to it. This can be very awesome when it comes to forensics acquisition.

To mount any NAS via SMB:

mount_smbfs afp://<username>@<NAS_IP>/<Share_for_backup> /<mountpoint>

To mount a Time Capsule share via AFP:

mount_afp afp://any_username:password@<Time_Capsule_IP>/<Share_for_backup> /<mountpoint>

And finally this command should do the job:

hdiutil attach test.sparsebundle -readonly

It is nice that you can provide read-only parameter.

If the backup was encrypted and you don't want to provide the password in a password prompt, use the following:

printf '%s' 'CorrectHorseBatteryStaple' | hdiutil attach test.sparsebundle -stdinpass -readonly

Note: if you receive the error "resource temporarily unavailable", probably another machine is backing up to the device

And now, you can find your backup disk under /Volumes. Happy restoring!

Probably it would have been quicker to either enable the remote GUI, or to physically travel to the system and login locally, but that would spoil the fun.

Related posts

1. Hacker Tools For Mac
2. Pentest Automation Tools
3. Hacker Tools Windows
4. Tools For Hacker
5. Hacks And Tools
6. Hacker Search Tools
7. Hacking Tools And Software
8. Hacking Tools
9. Pentest Tools For Windows
10. Pentest Tools Review
11. How To Install Pentest Tools In Ubuntu
12. Hak5 Tools
13. Hacker Tools List
14. Hack Tools For Windows
15. Hack Tools For Pc
16. Pentest Tools Port Scanner
17. Hacking Tools Kit
18. How To Install Pentest Tools In Ubuntu
19. Pentest Tools Find Subdomains
20. New Hack Tools
21. Hacking Tools Github
22. Pentest Tools For Windows
23. Pentest Tools Framework
24. Hacking Tools Hardware
25. Hack Tools
26. Hacking Tools Windows
27. Free Pentest Tools For Windows
28. Hacker Tools For Ios
29. Termux Hacking Tools 2019
30. Pentest Recon Tools
31. Hacker
32. Android Hack Tools Github
33. Pentest Tools Windows
34. Hacker Tools Online
35. Game Hacking
36. Hack Tools Pc
37. Hacker Tools Apk Download
38. Hacker Tools 2020
39. Hacker Search Tools
40. Pentest Tools Download
41. Usb Pentest Tools
42. Pentest Tools Url Fuzzer
43. Easy Hack Tools
44. Hacker Tools Hardware
45. Pentest Tools Linux
46. Tools Used For Hacking
47. Hacking Tools Software
48. Hacker Tools Online
49. Free Pentest Tools For Windows
50. Hacking Tools Pc
51. Hack Tools For Games
52. Hacker Tools For Ios
53. Hacking Tools Kit
54. Pentest Tools Url Fuzzer
55. Hacker Tools Apk Download
56. Tools For Hacker
57. Hacker Tools Windows
58. Pentest Tools Website Vulnerability
59. Hacker Security Tools
60. Pentest Tools Kali Linux
61. Tools Used For Hacking
62. Hacker Security Tools
63. Hack And Tools
64. Hacker Tools 2020
65. Pentest Tools Online
66. Ethical Hacker Tools
67. Hacker Tools 2020
68. Hacker Tools Free
69. Best Hacking Tools 2019
70. Hack Tools For Games
71. Hacker Tools Free Download
72. Hacking Tools For Beginners
73. Install Pentest Tools Ubuntu
74. Hacking Tools For Windows
75. Tools For Hacker
76. Pentest Tools Subdomain
77. Hack Tools For Ubuntu
78. Pentest Recon Tools
79. Pentest Tools Port Scanner
80. Pentest Tools Port Scanner
81. Hacking Tools For Mac
82. Hacker Tools Hardware
83. Hack And Tools
84. Hack Rom Tools
85. Pentest Tools Android
86. Beginner Hacker Tools
87. Growth Hacker Tools
88. Hacking Tools Kit
89. Nsa Hack Tools Download
90. Hacking Tools For Windows
91. Hacker Tools
92. Termux Hacking Tools 2019
93. Hack Tools For Games
94. Hacking Tools Windows 10
95. Pentest Tools Nmap
96. Install Pentest Tools Ubuntu
97. Hack Tool Apk
98. Hacking Tools Free Download
99. Pentest Tools Framework
100. Pentest Tools Android
101. Pentest Tools Alternative
102. Hacking Tools For Windows
103. Hacker Tools 2019
104. Hack Tools For Mac
105. Hacking Tools Kit
106. Top Pentest Tools
107. Growth Hacker Tools
108. Pentest Tools Kali Linux
109. Hacking Tools For Games
110. New Hacker Tools
111. Pentest Tools Online
112. Hacker Tools Online
113. Hacker
114. Github Hacking Tools
115. Blackhat Hacker Tools
116. Hack Tools Online
117. Hack Rom Tools
118. Hacking Tools And Software
119. New Hack Tools
120. Hacker Search Tools
121. Hack Tool Apk
122. Pentest Tools Url Fuzzer
123. Install Pentest Tools Ubuntu