RSS
 

Decrypting the iPhone keychain from backups

03 May

In iTunes backup, the iPhone Keychain sqlite database is stored as a Plist file. The Keychain file gets stored with 51a4616e576dd33cd2abadfea874eb8ff246bf0e file name in the iTunes backup folder.

Keychain data stored in the backup is encrypted using a hardware generated key – key 0×835. So renaming the file 51a4616e576dd33cd2abadfea874eb8ff246bf0e to keychain-backup.plist and editing with a plist editor opens the file but does not display the data in it.

Steps to decrypt the backup Keychain (Mac OS X):
1. Go to iTunes backup folder. Default location is -~/Library/Application Support/MobileSync/Backup/
2. Rename the file 51a4616e576dd33cd2abadfea874eb8ff246bf0e to keychain-backup.plist.
3. Extract key 0×835 by following my previous blog post – Extracting AES keys from iPhone.
4. Download & install mercurial. Researchers at sogeti developed tools to decrypt the keychain files. Grab the tools by running the below command on Mac OS X terminal.

hg clone https://code.google.com/p/iphone-dataprotection/

5. Install python dependencies.

sudo easy_install M2crypto construct progressbar setuptools
sudo ARCHFLAGS='-arch i386 -arch x86_64' easy_install pycrypto

6. Navigate to iphone-dataprotection folder and run keychain_tool.py by supplying keychain-backup.plist path and the backup folder path. 

cd iphone-dataprotection
python python_scripts/keychain_tool.py  ~/Library/Application Support/MobileSync/Backup/[UDID]/keychain-backup.plist   ~/Library/Application Support/MobileSync/Backup/[UDID]/Manifest.plist
7. The script prompts for key 0×835. key in the value obtained in step 2. keychain-tool.py automatically decrypts the backup keychain content and displays it on the terminal.


Steps to decrypt the backup Keychain (Windows 7):
1. Go to iTunes backup folder. Default location is - C:\Users\[user name]\AppData\Roaming\Apple Computer\MobileSync\Backup\
2. Rename the file 51a4616e576dd33cd2abadfea874eb8ff246bf0e to keychain-backup.plist.
3. Extract key 0×835 by following my previous blog post - Extracting AES keys from iPhone.
4. Download & install mercurial. Researchers at sogeti developed tools to decrypt the keychain files. Grab the tools by running the below command from windows command prompt. It creates iphone-dataprotection folder in the current directory.

hg clone https://code.google.com/p/iphone-dataprotection/

5. Download and install Python 2.6 in C:\Python26 folder.
6. Add C:\Python26 to system PATH environment variable.
7. Install windows openSSL
8. Install python dependencies - setuptoolsM2Cryptopycrypto & pyqt
9. Download progressbar-2.3.rar and extract it to c:\ drive. From command prompt navigate to c:\progressbar-2.3 and type the below command.

cd progressbar-2.3
python setup.py install

10. Download construct-2.06.rar and extract it to c:\ drive. From command prompt navigate to c:\construct-2.06 folder and type the below command.

cd construct-2.06
python setup.py install

11. From command prompt, navigate to iphone-dataprotection folder and run keychain_tool.py by supplying keychain-backup.plist path and the backup folder path. 

cd iphone-dataprotection
python python_scripts/keychain_tool.py  C:\Users\[user name]\AppData\Roaming\Apple Computer\MobileSync\Backup\[UDID]\keychain-backup.plist C:\Users\[user name]\AppData\Roaming\Apple Computer\MobileSync\Backup\[UDID]\Manifest.plist

* In the above command replace [user name] & [UDID] with appropriate values.

12. The script prompts for key 0×835. key in the value obtained in step 2. keychain-tool.py automatically decrypts the backup keychain content and displays it on the command prompt.

Note: keychain in the iTunes encrypted backup is stored encrypted with iTunes password. So while decrypting the keychain from iTunes encrypted backups, enter the backup password instead of key 0×835.

More detailed video demonstration is available at – iPhone forensics – Analysis of iOS 5 backups: video.

 
 

Tags: , , , , , , ,

Leave a Reply

 

 
  1. Reading iPhone Backups « SECURITYLEARN

    May 3, 2012 at 10:29 pm

    [...] 03-May-2012] Instructions to decrypt the backup keychain are available at – Decrypting the iPhone Keychain from backups Rate this: Share this:EmailFacebookLinkedInTwitterLike this:LikeBe the first to like this post. [...]

     
  2. Week 18 in Review – 2012 | Infosec Events

    May 8, 2012 at 3:38 pm

    [...] Decrypting the iPhone keychain from backups SECURITYLEARN – wordpress.com [...]

     
  3. Marcel

    May 26, 2012 at 4:35 am

    i get permission denied while running the script

     
    • Satish B

      May 26, 2012 at 6:41 am

      Type sudo command before the python statement. It will ask for Mac OS password. Then the script runs as root user.

       
  4. will

    May 26, 2012 at 10:22 pm

    can you make an instructional video?

     
    • Satish B

      May 27, 2012 at 9:39 am

      I am already preparing it. It will go live in another 10 days.

       
  5. Kel J.

    June 6, 2012 at 8:00 pm

    I’ve gotten as far as to extract the AES encryption keys from my iTouch. But decrypting the keychain-backup.plist file I’m stuck on since the command prompts for windows are different. Is there a tutorial for windows or something else that I can look at?

     
    • Satish B

      June 6, 2012 at 8:58 pm

      No tools are available for windows. May be you can download mac os x in a vm. Watch my old posts.

       
      • Kel J.

        June 6, 2012 at 9:13 pm

        Thanks

         
  6. Ben

    June 13, 2012 at 2:01 am

    Hi, I’m almost there, just getting one problem. when I run the final part, I get the following:

    python python_scripts/keychain_tool.py  ~/Library/Application Support/MobileSync/Backup/[UUID]/keychain-backup.plist ~/Library/Application Support/MobileSync/Backup/[UUID]/Manifest.plist
    Traceback (most recent call last):
    File “python_scripts/keychain_tool.py”, line 2, in
    from keystore.keybag import Keybag
    File “/Users/MacMini/iphone-dataprotection/python_scripts/keystore/keybag.py”, line 2, in
    from crypto.aes import AESdecryptCBC
    File “/Users/MacMini/iphone-dataprotection/python_scripts/crypto/aes.py”, line 1, in
    from Crypto.Cipher import AES
    ImportError: No module named Crypto.Cipher

    What could I be doing wrong?

    Many thanks.

     
    • Satish B

      June 13, 2012 at 7:29 am

      Install pycrypto module for python and it will work.

       
  7. legioxi

    June 13, 2012 at 8:35 pm

    Is there any reason the script output would be nothing after entering in the 835 key?

    I picked up the key from the other blog entry using the ./device_infos tool but I did not run the ./bruteforce tool. Is that tool required to get a correct 835 key? Could that be the reason my output is blank?

    Thanks for any help you can offer.

     
    • legioxi

      June 13, 2012 at 8:54 pm

      I figured it out – I used -d and it displayed the password I was looking for.

       
  8. Brandon

    July 2, 2012 at 6:57 pm

    hi Satish,

    nor matter how many time i tired after i key in the key835, it shown
    “Cannot decrypt backup keybag. Wrong password ?”

    followed step 1 – 5.

    could it be because the iphone being set as new device thus the key no longer matching? thanks.

     
    • Satish B

      July 2, 2012 at 8:45 pm

      Key 835 will remain same even after restore. R u decrypting the encrypted backup or normal backup? In case of encrypted backup you have to supply itunes password.

       
  9. Bhupinder

    July 27, 2012 at 9:55 pm

    what about windows? how to perform the steps in windows..with the command line..d file keychain_tool gives some syntax error :O i got the remainin keys n stuff

     
    • Satish B

      July 27, 2012 at 10:40 pm

      Installing python modules will resolve the problem. If not, share the error message.

       
  10. Bhupinder

    July 29, 2012 at 7:52 pm

    it shows the following error File “python_scripts/keychain_tool.py”, line 35
    print “This backup is not encrypted, without key 835 nothing in the keychain
    can be decrypted”

    ^
    syntaxError: invalid syntax

     
  11. Bhupinder

    July 29, 2012 at 7:53 pm

    can i send you the hash key along with the manifest and keychain-backup.plist files? pls i need the backup urgently :(

     
    • Satish B

      July 29, 2012 at 11:11 pm

      Have you obtained key 835? If so email (satishb3@hotmail.com) me those files and the key. I can decrypt for you.

       
  12. Bhupinder

    July 29, 2012 at 10:10 pm

    how do i install python modules?? and wer to place dem n stuff..

     
  13. Bhupinder

    July 30, 2012 at 12:06 am

    i got the key n d files.. ill mail dem to u.. decrypt it for me n send me the files please :) tanks..

     
  14. Bhupinder

    July 30, 2012 at 12:57 pm

    i ran the file it runs properly…only ting it cant decrypt the backup properly.. it says wrong password or somethin.. :/

     
  15. Gilles Letourneau

    August 17, 2012 at 8:14 pm

    Hi, I have a none encrypted backup of an iPhone 4/s. My software can see the info I need but in the iphone backup, but I also need the info in the keychain (wi-fi and email password etc.) I have a software called (iPhone Password Breaker) who can parse that info BUT to do that, I need to extract the keychain security key. I saw your instructions to extract the keychain from backup.. Somwhere in those instruction you say that I need to jailbrake the iPhone.. I don’t have the iPhone I only have the backup files from iTune. How can I extract the security key from those backup files ?

     
    • satishb3

      August 18, 2012 at 7:19 am

      The key is stored in the iPhone hardware. So it is not possible to read the backup keychain without the phone.

       
  16. Ryan

    August 24, 2012 at 3:07 pm

    When I run the script, it asks for module M2Crypto. Why does it ask for this module? I didn’t see it listed in the dependencies.

     
    • satishb3

      August 25, 2012 at 8:22 am

      M2Crypto is required to run the keychain_tool.py. See this for the required dependencies – http://code.google.com/p/iphone-dataprotection/wiki/README

       
      • elitehut

        October 14, 2012 at 9:50 am

        any chance there is something like this for ios 6? thx

         
        • satishb3

          October 14, 2012 at 9:57 am

          It works for ios 6 as well. Did you try running the scripts?

           
          • elitethut

            October 14, 2012 at 10:19 am

            yes I finally got it to work until the point where it needs the 835…not sure what I should enter now, since the script to get the key is 5.x compatible.

             
          • elitethut

            October 14, 2012 at 10:25 am

            my backup is already encrypted though…the password is simply 91101991.

             
          • satishb3

            October 14, 2012 at 11:26 am

            If the backup is encrypted , the script prompts to enter your password. Enter 911…. Later when it asks for key 835 just hit enter.

            If u need help watch my video climax at “iphone forensics on backups -video” blog post.

             
          • elitethut

            October 14, 2012 at 8:14 pm

            hmm weird…it never asks for a password…just for key 835. But the backup clearly is encrypted… I just made a fresh backup to make sure.

             
          • elitethut

            October 14, 2012 at 8:15 pm

            Is it normal that when renaming 51a46… to keychain-backup.plist, when I try to open keychain-backup.plist after that, I get “The document “keychain-backup-plist” could not be opened. Conversion of string failed. The string is empty”

             
          • elitethut

            October 14, 2012 at 9:18 pm

            got it to work, thanks to your video! thank you

             
        • vonhardy

          October 14, 2012 at 10:18 am

          If my backup is encrypted, then I can skip the part where I need to find the 835? and let’s say my encryption password is “123″. Then what do I enter when the script requests the key835? “123″? or “7B” maybe? thanks

           
          • satishb3

            October 14, 2012 at 11:22 am

            When it asks for key835 just hit keyboard enter

             
  17. Jay

    October 17, 2012 at 9:19 am

    For some reason Yahoo Mail password is not stored in the keychain. Is there way to retrive this password?

     
    • satishb3

      October 17, 2012 at 1:23 pm

      To my knowledge, No.

       
      • Jay

        October 17, 2012 at 6:30 pm

        Its stored as cookie. I have password saved on my ipod but I forgot the password for it. Might have to use the yahoo token from ipod to login and change the password.

         
        • satishb3

          October 17, 2012 at 10:03 pm

          Old token might work. It might ask for old password when you want to change.

           
  18. sotavento bcn

    November 9, 2012 at 10:45 am

    Thank you for any other excellent article. The place else could anybody get that kind of info in such a perfect method of writing? I’ve a presentation subsequent week, and I am on the search for such information.

     
  19. Peter

    November 12, 2012 at 5:42 am

    I am using iPhone 5 on iOS 6.0.1 with an ENCRYPTED iTunes backup. When attempting to decrypt the iPhone keychain it comes up saying:

    FAIL: keybag type > 3 : 1073741825
    unlockBackupKeybagWithPasscode: not a backup keybag
    Cannot decrypt backup keybag. Wrong password ?

    Have you any advice? I have tried both pushing enter when it asks for 0×835 as well as putting the iTunes backup password in here. At no stage does it ask for the iTunes backup password.

    Many thanks!

    Peter :)

     
    • satishb3

      November 12, 2012 at 6:56 am

      Try editing keystore/keybag.py file and change the line ‘if self.type > 3:’ to ‘if self.type > 4:’. Then run the keychain_tool.py. It might work.

       
      • Peter

        November 12, 2012 at 1:27 pm

        Thanks for your speedy reply. I tried what you mentioned with no effect, same error still comes up. Was definitely the right file as well, as I changed the PRINT output slightly so I could double-check! :-/

         
        • satishb3

          November 12, 2012 at 7:58 pm

          Try this, replace self.type=data with self.type=1

          self.type = data
          if self.type > 3:

           
          • Peter

            November 13, 2012 at 2:13 am

            Thanks again for your quick reply!

            Still having no joy, no longer comes up with FAIL keybag type, but instead comes across with JUST the following:

            Cannot decrypt backup keybag. Wrong password ?

            Starting to think this script might be incompatible with iPhone 5 backups… :-/

            Thanks for all your help though, really appreciate your response!

             
          • satishb3

            November 13, 2012 at 7:21 am

            The script worked with ios 6 backups. May be apple changed the encryption mechanism in 6.0.1. Will update you if i find anything that helps you.

             
  20. Mark

    November 23, 2012 at 2:36 pm

    Hi,

    Excellent guide!, i’m just trying to recover an old email password. Everything was great until it came to the kernel_patch. I have 6.0.1 is there anything available for this yet?

    Thanks

     
    • satishb3

      November 23, 2012 at 4:12 pm

      Kernel patch is not available for 6.0.1.

      Which iphone are you using? 4 or 4s?

       
      • Mark

        November 23, 2012 at 5:24 pm

        iPhone 4

         
        • satishb3

          November 24, 2012 at 4:33 pm

          One way to recover your password from old keychain –
          1. Copy your backup folder to some other location (backup of your backup folder)
          2. Take a backup of your phone
          3. Copy the new backup folder to some other location
          4. Copy old backup to iTunes backup folder
          5. Restore the iPhone with old backup
          6. Jailbreak your iphone
          7. Follow this guide – keychain dumper usage

           
          • james

            November 25, 2012 at 8:40 am

            i have a problem when loading the m2crypto..
            It starts to run _init_.py but fails when trying to import
            _m2crypto. It says the dll load failed: The specific module could not be found

            I dont understand either. I can see the file in the directory
            C:\Python26\Lib\site-packages\M2Crypto

             
          • james

            November 25, 2012 at 9:11 am

            i googled and found out installing openssl would take care of that issue and it has but now im stuck with an io error

            C:\iphone-dataprotection>python python_scripts/keychain_tool.py C:\Users\jarmster\AppData\Roaming\Apple Computer\MobileSync\Backup\dcb08092d7e21313cf9750cca26d10cb6db7701d\Manifest.plist
            Traceback (most recent call last):
            File “python_scripts/keychain_tool.py”, line 72, in
            main()
            File “python_scripts/keychain_tool.py”, line 27, in main
            p = readPlist(args[1])
            File “C:\iphone-dataprotection\python_scripts\util\__init__.py”, line 45, in r
            eadPlist
            f = open(filename,”rb”)
            IOError: [Errno 2] No such file or directory: ‘Computer\\MobileSync\\Backup\\dcb
            08092d7e21313cf9750cca26d10cb6db7701d\\Manifest.plist’

             
          • satishb3

            November 25, 2012 at 10:47 am

            you need to supply two parameters for keychain_tool. One is keychain and the other one is manifest file.

             
          • satishb3

            November 25, 2012 at 10:48 am

            Glad that you have figured it out. I will update the dependencies list.

             
          • ben

            November 30, 2012 at 7:48 am

            Hello,

            Thanks for this demo

            I experiment problem to decrypt my backup. Here the script output :

            Backup is encrypted
            _debug test1234
            FAIL: keybag type > 4 : 1073741825
            unlockBackupKeybagWithPasscode: not a backup keybag
            Cannot decrypt backup keybag. Wrong password ?

            So the key is correct… Is it compatible with this firmware ?

            Product Type : iPad3,3
            Product Version : 6.0
            iTunes Version : 10.6.3

             
          • satishb3

            December 10, 2012 at 7:30 pm

            seems it is not supporting ipad 3,3. If i find a way to decrypt, i will update you.

             
  21. Justlurkin

    November 29, 2012 at 9:04 pm

    Can someone please help me with duplicating (cloning) an app that seems to use a keychain on the original download from the app store to store the device udid?

    When I use iFile to clone the app, and then change the UDID for the clone, it immediately detects that the UDID is fake. I have used other tutorials on cloning and none of them seem to work.

    Any info would be greatly appreciated. I am sick of banging my head against the wall on this one.

     
    • satishb3

      December 10, 2012 at 7:34 pm

      If i understood it correctly, you are trying to fake UDID. Use Gorilla to fake UDID.

       
  22. MotC

    April 13, 2013 at 2:54 am

    After entering the 835key, I get nothing so I tried with -d and this is what I got:
    bash-3.2$ python python_scripts/keychain_tool.py ~/Library/Application\ Support/MobileSync/Backup/cb2448ffdbd2dd1e923c8fd68a97c7f4dbdce55b/keychain-backup.plist ~/Library/Application\ Support/MobileSync/Backup/cb2448ffdbd2dd1e923c8fd68a97c7f4dbdce55b/Manifest.plist -d
    Traceback (most recent call last):
    File “python_scripts/keychain_tool.py”, line 72, in
    main()
    File “python_scripts/keychain_tool.py”, line 52, in main
    k.print_all(options.sanitize)
    File “/Users/iphone-dataprotection/python_scripts/keychain/keychain.py”, line 134, in print_all
    for p in self.get_passwords():
    File “/Users/iphone-dataprotection/python_scripts/keychain/keychain.py”, line 65, in get_passwords
    return self.get_items(“genp”)
    File /iphone-dataprotection/python_scripts/keychain/keychain.py”, line 61, in get_items
    self.items[table] = filter(lambda x:x!={}, map(self.decrypt_item, self.store.get_items(table)))
    File “/Users/iphone-dataprotection/python_scripts/keychain/keychain4.py”, line 39, in decrypt_item
    version, clas = struct.unpack(“<LL", row["data"][0:8])

    Any ideas what I did wrong?

     
    • satishb3

      April 13, 2013 at 8:37 am

      Not able to figure out anything from it. Is that the complete error ?

       
      • MotC

        April 13, 2013 at 9:33 am

        That is about all I get. When I do not put -d it returns nothing. Is that what it is suppose to do?

        What I am looking to do is to get my daughters gmail password off of here old Ipod. She got a new Ipad mini, but I can not remember her password so I thought I might be able to get it this way.

         
        • satishb3

          April 13, 2013 at 9:48 am

          So no result when -d is not specified. It indicates key 835 could be wrong.

           
  23. Ben

    May 8, 2013 at 9:51 pm

    iPhone 5 (iOS 6.0.2)(unjailbroken), encrypted backup in iTunes with known password.

    I am trying to recover the passcode to unlock the iPhone. Is the passcode is backed up in encrypted iTunes backup? Can I use the method detailed above to recover my passcode?

    I tried the method and this is what I got
    —–output—–
    If you have key835 for device enter it
    (in hex)

    Cannot decrypt backup keybag. Wrong password ?
    —–output—–
    I tried the iTunes backup password, blank password, even the iTunes backup password in hex, but nothing works.

    It never asked for my iTunes backup encryption password.

    Anyway to get passcode by brute force?

    Any help please?

     
    • satishb3

      May 10, 2013 at 3:03 pm

      Yes. The iPhone passcode will be stored in the keychain file in iTunes backup.
      If the python script does not ask you for iTunes password, it means that the backup is not encrypted. Are you sure that your backup is encrypted ?

       
  24. Craid

    May 13, 2013 at 6:33 pm

    I followed all instructions, everything is good. My mail password was not in the manifest file? Is there a way to retrieve this?

    This is the only password I need from my phone.

     
    • Craid

      May 13, 2013 at 7:21 pm

      I have encrypted the backup so it includes ‘account passwords used on this iphone’ (according to itunes

      The problem is now that when I go to decrypt the backup it asks for the 835 which I provide, I then get an error message saying ‘Cannot decrypt keybag. Wrong password?

      To get round this I have set the password for the itunes backup the exact same as the 835 key, when I enter it I get the same error message…..what could I be doing wrong?

      Lets pretend the password and 835 key is ’123′ when it asks for the key I enter 123, should I do 123 123 to signify the 835 code and itunes code?

      Please help as this is urgent

       
      • satishb3

        May 13, 2013 at 9:54 pm

        IF the backup is encrypted you just need to enter iTunes password. When it prompted for key 835 just hit enter.

         
        • Craig

          May 14, 2013 at 12:30 pm

          I will try this and let you know how I get on…thank you in advance for your help

           
          • Craig

            May 14, 2013 at 12:43 pm

            I just pressed enter when prompted for the 835 key yet I am receiving the wrong password error message. The cmd doesnt actually prompt me for an itunes password.

            What could I be doing wrong?

            I backup the iphone with an itunes password so it is encrypted, then I go to the command prompt cd c:\iphone-dataprotection

            then I run the python command with the correct values, I am only being prompted for a 835 key passwrd

            If it helps the iPhone 4 is running iOS 5.1.1

             
          • satishb3

            May 14, 2013 at 8:04 pm

            Its weird. I recommend to delete the existing backup and take a new encrypted backup. That might work.

             
          • Craig

            May 14, 2013 at 8:21 pm

            I have tried this, if possible could you come on skype? I will set you up a VPN connection or Teamviewer session so you could help assist me?

            I have tried everything, numerous backups

            Maybe a brief video from you would help?

             
          • satishb3

            May 14, 2013 at 9:24 pm

            I already made a video. Checkout “forensic analysis of ios backup” video from YouTube.com/seclearn
            If it does not work i can help you on Skype tomorrow. Get it touch on my email – satishb3@hotmail.com

             
  25. Craig

    June 5, 2013 at 8:28 pm

    I will be emailing you at some point possibly saturday as nothing I have tried has worked.

    Thank you in advance for your help it is greatly appreciated.

     
  26. cetin

    June 26, 2013 at 4:59 am

    hi satishB, I recently spoke to you on emails,my query is that im trying to recover iphone4 6.1.2 passwords from a backup on my laptop it is unencrypted,but I used Oxygen plist viewer for the key chain and it indicates that there are 22 keys stored but wont let me see them as its a trial version of the software,i cant stress how desperate I am to get these passwords can you please please please look at this backup I would like to send you the backup file…
    I tried to follow your guide on how to decrypt the iphone backup keychain but im having problems with my laptop “Acer windows 7 64bit” it wont let me download python even though I disabled the antivirus I just cant do it man I really need you to look at this backup pleaseeeee…..

     
    • satishb3

      June 26, 2013 at 7:23 am

      the keychain is encrypted with a encryption key available on the phone. If you don’t have the phone there is no way to decrypt it.

       
  27. cetin

    June 26, 2013 at 7:50 pm

    what if the backup was fully encypted,do I still need to have physical access to the iphone to be able to get the passwords stored on it?

     
    • satishb3

      June 26, 2013 at 8:13 pm

      if the backup is encrypted and if you know the backup password, we can get the keychain items easily.

       
  28. Demostenes

    January 1, 2014 at 2:22 pm

    Hi!

    Can i decrypt files from old encrypted backup, when i have two files: one the original unencrypted file, and second is the same file, bud encrypted?
    Have someonek solution?

    thx

     
    • satishb3

      January 2, 2014 at 6:58 pm

      There is not way to decrypt old backup files until you know the password.

       
      • Pez8210

        January 28, 2014 at 6:03 pm

        Hello

        I´m trying with a IOS 7 encrypted backup with known password but only get Wrong Password

        I tried in dec 12345 and hex 3039 but no way I suppose Apple changes something in IOS7

         
        • satishb3

          January 28, 2014 at 8:08 pm

          There is nothing changed in iOS 7. It should work.

           
          • cme1873

            February 4, 2014 at 11:00 am

            I can’t figure out my yahoo email password as it is encrypted but my hotmail one shows my password when I use keychain dumper tool. Is there any help you can give. I have the phone and it is iphone 4s running ios 6 and I know my passwords on the phone as well as the backup password. Just can’t remember my yahoo email.

             
          • satishb3

            February 4, 2014 at 8:46 pm

            Not all apps store clear text passwords in keychain or on the device. Probably yahoo mail is one of them.

             
        • goonleader

          February 25, 2014 at 8:16 pm

          Did you ever get it to work with IOS 7??

           
  29. Josh

    March 15, 2014 at 11:09 am

    Please help, I’m getting this error

    python python_scripts/keychain_tool.py ~/Library/Application Support/MobileSync/Backup/fbe55fe76a429541406fb2a80fd49c40c028e73c/keychain-backup.plist ~/Library/Application Support/MobileSync/Backup/fbe55fe76a429541406fb2a80fd49c40c028e73c/Manifest.plist
    Traceback (most recent call last):
    File “python_scripts/keychain_tool.py”, line 72, in
    main()
    File “python_scripts/keychain_tool.py”, line 27, in main
    p = readPlist(args[1])
    File “/Users/Bonn/iphone-dataprotection/python_scripts/util/__init__.py”, line 45, in readPlist
    f = open(filename,”rb”)
    IOError: [Errno 2] No such file or directory: ‘Support/MobileSync/Backup/fbe55fe76a429541406fb2a80fd49c40c028e73c/keychain-backup.plist’