Recovering Data From An Old Encrypted Time Machine Backup

Recovering data from a backup should be an easy thing to do. At least this is what you expect. Yesterday I had a problem which should have been easy to solve, but it was not. I hope this blog post can help others who face the same problem.

The problem

1. I had an encrypted Time Machine backup which was not used for months
2. This backup was not on an official Apple Time Capsule or on a USB HDD, but on a WD MyCloud NAS
3. I needed files from this backup
4. After running out of time I only had SSH access to the macOS, no GUI

The struggle

By default, Time Machine is one of the best and easiest backup solution I have seen. As long as you stick to the default use case, where you have one active backup disk, life is pink and happy. But this was not my case.

As always, I started to Google what shall I do. One of the first options recommended that I add the backup disk to Time Machine, and it will automagically show the backup snapshots from the old backup. Instead of this, it did not show the old snapshots but started to create a new backup. Panic button has been pressed, backup canceled, back to Google.

Other tutorials recommend to click on the Time Machine icon and pressing alt (Option) key, where I can choose "Browse other backup disks". But this did not list the old Time Machine backup. It did list the backup when selecting disks in Time Machine preferences, but I already tried and failed that way.

YAT (yet another tutorial) recommended to SSH into the NAS, and browse the backup disk, as it is just a simple directory where I can see all the files. But all the files inside where just a bunch of nonsense, no real directory structure.

YAT (yet another tutorial) recommended that I can just easily browse the content of the backup from the Finder by double-clicking on the sparse bundle file. After clicking on it, I can see the disk image on the left part of the Finder, attached as a new disk.
Well, this is true, but because of some bug, when you connect to the Time Capsule, you don't see the sparse bundle file. And I got inconsistent results, for the WD NAS, double-clicking on the sparse bundle did nothing. For the Time Capsule, it did work.
At this point, I had to leave the location where the backup was present, and I only had remote SSH access. You know, if you can't solve a problem, let's complicate things by restrict yourself in solutions.

Finally, I tried to check out some data forensics blogs, and besides some expensive tools, I could find the solution.

The solution

Finally, a blog post provided the real solution - hdiutil.
The best part of hdiutil is that you can provide the read-only flag to it. This can be very awesome when it comes to forensics acquisition.

To mount any NAS via SMB:

mount_smbfs afp://<username>@<NAS_IP>/<Share_for_backup> /<mountpoint>

To mount a Time Capsule share via AFP:

mount_afp afp://any_username:password@<Time_Capsule_IP>/<Share_for_backup> /<mountpoint>

And finally this command should do the job:

hdiutil attach test.sparsebundle -readonly

It is nice that you can provide read-only parameter.

If the backup was encrypted and you don't want to provide the password in a password prompt, use the following:

printf '%s' 'CorrectHorseBatteryStaple' | hdiutil attach test.sparsebundle -stdinpass -readonly

Note: if you receive the error "resource temporarily unavailable", probably another machine is backing up to the device

And now, you can find your backup disk under /Volumes. Happy restoring!

Probably it would have been quicker to either enable the remote GUI, or to physically travel to the system and login locally, but that would spoil the fun.

Related links

1. Pentest Tools Kali Linux
2. Hacking Tools Usb
3. Pentest Tools Find Subdomains
4. Best Hacking Tools 2020
5. Pentest Tools List
6. Nsa Hacker Tools
7. Hacking Tools And Software
8. Blackhat Hacker Tools
9. Pentest Tools Nmap
10. Hacking Tools 2019
11. Pentest Tools Url Fuzzer
12. Hacker Tools
13. New Hack Tools
14. New Hacker Tools
15. Nsa Hack Tools
16. Hacker Tools Linux
17. Pentest Recon Tools
18. Hack Tools For Pc
19. Ethical Hacker Tools
20. Hacker Tools Software
21. Pentest Tools Windows
22. Hack Tools For Mac
23. Hacker Hardware Tools
24. Pentest Tools Windows
25. Hacking App
26. Pentest Tools Windows
27. Hacking Tools Github
28. Hack And Tools
29. Install Pentest Tools Ubuntu
30. Hack Website Online Tool
31. Hackers Toolbox
32. Pentest Tools Free
33. Hacking Tools Pc
34. Hack Tools Download
35. Hack Rom Tools
36. Blackhat Hacker Tools
37. New Hacker Tools
38. Pentest Tools Free
39. Hacking Tools For Mac
40. Hacker Techniques Tools And Incident Handling
41. Hacker Tool Kit
42. Pentest Tools For Windows
43. Hacker Tools Hardware
44. Hack Tools For Games
45. Hack Tools Download
46. Pentest Tools Free
47. Hacker Tools List
48. Hacker Tool Kit
49. Hacking Tools Software
50. Hack Rom Tools
51. Hacker Hardware Tools
52. New Hack Tools
53. Android Hack Tools Github
54. Pentest Tools Kali Linux
55. Hacking Tools Pc
56. Hacking Tools Windows
57. Nsa Hacker Tools
58. Hacker Tools For Mac
59. Pentest Tools Windows
60. Physical Pentest Tools
61. How To Hack
62. Hack Tools For Games
63. Hacking Tools Hardware
64. Hacker Tools Free Download
65. Hacking Tools Name
66. Pentest Tools Find Subdomains
67. Hacking Tools For Mac
68. New Hacker Tools
69. Hack Tool Apk No Root
70. Pentest Tools Github
71. Pentest Tools Find Subdomains
72. Hacking Tools And Software
73. Hacking Tools Download
74. Hack Apps
75. Hack Tools For Windows
76. Pentest Tools Kali Linux
77. Hacker Tools Apk Download
78. Hack Tools For Games
79. Hack App
80. Hacking Tools For Games
81. Best Pentesting Tools 2018
82. How To Make Hacking Tools
83. Pentest Tools For Android
84. Hack Tools
85. Hack Tools Pc
86. Hacker Tools For Mac
87. Hacking Tools Kit
88. Pentest Tools For Ubuntu
89. Hacker Tools 2020
90. Hacking Tools Kit
91. Hacking Tools Download
92. Hack Tools For Ubuntu
93. Hacking Tools Kit
94. Hack Tools 2019
95. Pentest Tools Framework
96. Hacker Tools For Mac