Recover files from pass protected MAC

[BuRaK]

Hi everyone,

I have a client whose sister passed away and there are important files that needs to be recovered but no one can figure out what the password is.

Any ideas?

THANKS!!!

 

[Xander]

Google came up with nothing?

 

[16k_zx81]

Sorry to break this to you. It's impossible. Mac passwords are completely uncrackable, and user accounts that are password protected have special 1024 bit xkjs file encryption. Those files can never be recovered. Ever.

 

[anonymous Mac Tech]

Sorry to break this to you. It's impossible. Mac passwords are completely uncrackable, and user accounts that are password protected have special 1024 bit xkjs file encryption. Those files can never be recovered. Ever.

If the drive has filevault enabled (or the old filevault). If it's filevault 2 from OS10.7.x or never their Apple id and password may be an option for unlocking filevault. Otherwise a simple password reset.

 

[Brand]

Those files can never be recovered. Ever.

That a pretty bold statement given you don't know what processing power the future holds.

 

[16k_zx81]

If the drive has filevault enabled (or the old filevault). If it's filevault 2 from OS10.7.x or never their Apple id and password may be an option for unlocking filevault. Otherwise a simple password reset.

Sorry, I thought the whole thing was a joke, hence Xanders response.

I admire your sincerity, but this is still a forum for Technicians, right?

 

[PaulRome]

If it's just the user acct

mount -uw /
rm /var/db/.AppleSetupDone
shutdown -h now

Will trick the comp to run the initial setup again, and the old acct will still be there. You can go and change the old acct password.

 

[16k_zx81]

That a pretty bold statement given you don't know what processing power the future holds.

You're obviously not familiar with the 1024-bit xkjs encryption protocol

 

[PaulRome]

You're obviously not familiar with the 1024-bit xkjs encryption protocol

Oh my, I miss that also. Nice one.

 

[altrenda]

If it's just the user acct

mount -uw /
rm /var/db/.AppleSetupDone
shutdown -h now

Will trick the comp to run the initial setup again, and the old acct will still be there. You can go and change the old acct password.

I bet it took you longer to type this answer than it would take to google it.

It will probaly take a google search anyway to find where to enter this code.

 

[PaulRome]

Saw it on youtube months ago. Ctrl + S on startup to bring up the terminal.

 

[nightkingdoms]

It takes about 5 mins to remove passwords on a Mac, 48 secs flat is my removal time on Winblow$. Linux, well, weeks. lol

For removing the passwords, we should all know how to do it on Windows, but any password removing instructions should really be posted in the Tech's Only forum just so the sure-fire methods aren't readily attainable from a Google search. The general public should have to work for it. ;O)

 

[altrenda]

Yep, it's a common last resort kind of user password reset, when you don't have an install disk available. Not the preferable way, but it works.

As Xander said, not sure why the OP didn't google for this info before asking here.

 

[PaulRome]

For removing the passwords, we should all know how to do it on Windows, but any password removing instructions should really be posted in the Tech's Only forum just so the sure-fire methods aren't readily attainable from a Google search. The general public should have to work for it. ;O)

Thats why I wrapped it php tags.

 

[BuRaK]

Thanks for all the lovely help friends.

How about the old school way of removing the hard drive and plugging it into another mac's with a USB adapter?

Can't we get the files out that way?

 

[anonymous Mac Tech]

Sorry, I thought the whole thing was a joke, hence Xanders response.

I admire your sincerity, but this is still a forum for Technicians, right?

What I'm saying is maybe OP is misunderstanding a simple password reset from the drive actually being Filevault encypted. If it's the older version of fielvault and they don't know the master password then they truly are screwed. But like I stated earlier if it's filevault 2 there may be other alternatives. It really isn't obvious to someone unfamiliar with Macs to know the difference between just being locked out or if the drive is filevault encypted. Maybe I'm just looking into this too much, but I'm trying to give OP benefit of doubt.

Thanks for all the lovely help friends.

How about the old school way of removing the hard drive and plugging it into another mac's with a USB adapter?

Can't we get the files out that way?

Why would you rather remove the drive, then to ignore the many other suggestions you have received? I'm trying to help and defend you in this thread, but now you are making it difficult...

 

[BuRaK]

Why would you rather remove the drive, then to ignore the many other suggestions you have received? I'm trying to help and defend you in this thread, but now you are making it difficult...[/QUOTE]

I didn't know I was being attacked

Sure I'll try the methods here, always good to learn something new

 

[KH58]

An old thread, I know. But many times on personal Macs there IS no password. When the prompt comes up, first try hitting enter leaving the password field empty.

 

[ohio_grad_06]

The easy way is if you have another Mac, boot up the Mac you are working on into target mode, just hold down the T key as you boot. This should make the machine boot in target mode acting like a giant external drive and you should be able to hook up via fire etc to another Mac and see files.

If its an intel Mac, wouldn't a Linux live cd work such as Ubuntu?

 

[altrenda]

While these are viable, how are they easier than using an install disk, recovery mode, or entering some lines in single user mode? After which you have access to everything on the machine?

If you go the target mode route and are dealing with various generations of Mac, you need to have the right FireWire cable.