Better information... Better health

Recovering data from a backup should be an easy thing to do. At least this is what you expect. Yesterday I had a problem which should have been easy to solve, but it was not. I hope this blog post can help others who face the same problem.

The problem

1. I had an encrypted Time Machine backup which was not used for months
2. This backup was not on an official Apple Time Capsule or on a USB HDD, but on a WD MyCloud NAS
3. I needed files from this backup
4. After running out of time I only had SSH access to the macOS, no GUI

The struggle

By default, Time Machine is one of the best and easiest backup solution I have seen. As long as you stick to the default use case, where you have one active backup disk, life is pink and happy. But this was not my case.

As always, I started to Google what shall I do. One of the first options recommended that I add the backup disk to Time Machine, and it will automagically show the backup snapshots from the old backup. Instead of this, it did not show the old snapshots but started to create a new backup. Panic button has been pressed, backup canceled, back to Google.


Other tutorials recommend to click on the Time Machine icon and pressing alt (Option) key, where I can choose "Browse other backup disks". But this did not list the old Time Machine backup. It did list the backup when selecting disks in Time Machine preferences, but I already tried and failed that way.


YAT (yet another tutorial) recommended to SSH into the NAS, and browse the backup disk, as it is just a simple directory where I can see all the files. But all the files inside where just a bunch of nonsense, no real directory structure.

YAT (yet another tutorial) recommended that I can just easily browse the content of the backup from the Finder by double-clicking on the sparse bundle file. After clicking on it, I can see the disk image on the left part of the Finder, attached as a new disk.
Well, this is true, but because of some bug, when you connect to the Time Capsule, you don't see the sparse bundle file. And I got inconsistent results, for the WD NAS, double-clicking on the sparse bundle did nothing. For the Time Capsule, it did work.
At this point, I had to leave the location where the backup was present, and I only had remote SSH access. You know, if you can't solve a problem, let's complicate things by restrict yourself in solutions.

Finally, I tried to check out some data forensics blogs, and besides some expensive tools, I could find the solution.

The solution

Finally, a blog post provided the real solution - hdiutil.
The best part of hdiutil is that you can provide the read-only flag to it. This can be very awesome when it comes to forensics acquisition.


To mount any NAS via SMB:

mount_smbfs afp://<username>@<NAS_IP>/<Share_for_backup> /<mountpoint>

To mount a Time Capsule share via AFP:

mount_afp afp://any_username:password@<Time_Capsule_IP>/<Share_for_backup> /<mountpoint>

And finally this command should do the job:

hdiutil attach test.sparsebundle -readonly

It is nice that you can provide read-only parameter.

If the backup was encrypted and you don't want to provide the password in a password prompt, use the following:

printf '%s' 'CorrectHorseBatteryStaple' | hdiutil attach test.sparsebundle -stdinpass -readonly

Note: if you receive the error "resource temporarily unavailable", probably another machine is backing up to the device

And now, you can find your backup disk under /Volumes. Happy restoring!

Probably it would have been quicker to either enable the remote GUI, or to physically travel to the system and login locally, but that would spoil the fun.

Related news

1. Pentest Tools Framework
2. Top Pentest Tools
3. Hacker Tools Github
4. How To Hack
5. Hacking Tools For Pc
6. How To Install Pentest Tools In Ubuntu
7. Hacker Tools Mac
8. Hack Tools For Windows
9. Hacker Tools For Mac
10. Hacking Tools Free Download
11. Top Pentest Tools
12. Hacking Tools Hardware
13. Hacking Tools Mac
14. Hacker Tools For Ios
15. Pentest Tools For Windows
16. How To Make Hacking Tools
17. Pentest Tools Github
18. Hacker Search Tools
19. Best Pentesting Tools 2018
20. What Are Hacking Tools
21. Hack And Tools
22. Game Hacking
23. Top Pentest Tools
24. Hack Tools For Windows
25. Hacks And Tools
26. How To Make Hacking Tools
27. Hacker Tools 2019
28. Hacker Tools For Ios
29. Hacking Tools For Windows
30. Hacker Hardware Tools
31. Pentest Tools For Android
32. Hacker Tools For Windows
33. Hacker Tools Apk
34. Hacking Tools Mac
35. Hacking Tools Windows 10
36. Hacker Tools Mac
37. Pentest Box Tools Download
38. Hacking Tools Online
39. Hackrf Tools
40. Pentest Tools Nmap
41. Hack Tools Pc
42. Pentest Tools Free
43. Hacking Tools For Pc
44. How To Install Pentest Tools In Ubuntu
45. Pentest Reporting Tools
46. Hacking Tools 2020
47. Hacker Tools Software
48. Hacker Tools Mac
49. Pentest Tools Alternative
50. Hacking Tools For Pc
51. Hacking Tools Kit
52. Growth Hacker Tools
53. Tools Used For Hacking
54. Top Pentest Tools
55. Pentest Tools For Android
56. Hacking Tools
57. Hacking Tools For Windows Free Download
58. Pentest Tools Website
59. Hacker Tools For Ios
60. Hacker Tools Hardware
61. Hack Tools For Ubuntu
62. Hacker Tools Github
63. Hak5 Tools
64. Pentest Tools For Windows
65. Hack Tools
66. What Is Hacking Tools
67. Hacker Techniques Tools And Incident Handling
68. Hacker Tools Hardware
69. Best Pentesting Tools 2018
70. Pentest Automation Tools
71. Pentest Tools
72. Hack Rom Tools
73. Hack Tools Mac
74. Usb Pentest Tools
75. Hacking Tools 2020
76. Hacker Tools Apk Download
77. Hacker Tools 2019
78. Pentest Tools For Windows
79. Hack Tools
80. Hacking Tools For Windows 7
81. Bluetooth Hacking Tools Kali
82. Hacking Apps
83. Pentest Tools Open Source
84. New Hacker Tools
85. Hack Tools Online
86. Hacker Tools Linux
87. Hacker Tools Free
88. Pentest Tools Kali Linux
89. Hack Tools Mac
90. Hacking App
91. Bluetooth Hacking Tools Kali
92. Pentest Tools Kali Linux
93. Hacking Tools For Windows