hello, a customer needs to find the passwords of this mail accounts on a macbook.
when he goes with safari to hotmail.com or yahoo.com the account logs in automatically, so the passwords are stored.
he made a full backup of the disk, not using any forensic software.
how can i retrieve the passwords?thanks
If the machine is accessible/working, it would be much easier to look for them on the Macbook directly
http//
http//
jaclaz
machine is not in my hands anymore, i only have a backup
What kind of image is it ?
Make a virtual machine from a copy of your image, boot it and use jaclaz's hints for revealing the passwords.
machine is not in my hands anymore, i only have a backup
To be fair, I didn't ask if it was in your hands, only if it was working and accessible. i.e. you can tell your customer (who presumably has the machine) to look for them himself.
Otherwise you will need to look for the appropriate keychain file (which may or may not be present in the backup), Safari on MacOs X should use the "centralized" login.keychain
https://
http//
The user of a Mac OS X system will be allocated a login keychain when their account is created. The location of this keychain will be as follows –
~/Library/Keychains/login.keychain
In this case the tilde (~) character represents the user’s home folder, which will normally be located in the following path –
/Users/<user-name>
I don't think it is easy-peasy to decode one of those files.
jaclaz
in windows with ftk it's easy, but os is very difficult for me