Recovering data from a backup should be an easy thing to do. At least this is what you expect. Yesterday I had a problem which should have been easy to solve, but it was not. I hope this blog post can help others who face the same problem.
2. This backup was not on an official Apple Time Capsule or on a USB HDD, but on a WD MyCloud NAS
3. I needed files from this backup
4. After running out of time I only had SSH access to the macOS, no GUI
As always, I started to Google what shall I do. One of the first options recommended that I add the backup disk to Time Machine, and it will automagically show the backup snapshots from the old backup. Instead of this, it did not show the old snapshots but started to create a new backup. Panic button has been pressed, backup canceled, back to Google.
Other tutorials recommend to click on the Time Machine icon and pressing alt (Option) key, where I can choose "Browse other backup disks". But this did not list the old Time Machine backup. It did list the backup when selecting disks in Time Machine preferences, but I already tried and failed that way.
YAT (yet another tutorial) recommended to SSH into the NAS, and browse the backup disk, as it is just a simple directory where I can see all the files. But all the files inside where just a bunch of nonsense, no real directory structure.
YAT (yet another tutorial) recommended that I can just easily browse the content of the backup from the Finder by double-clicking on the sparse bundle file. After clicking on it, I can see the disk image on the left part of the Finder, attached as a new disk.
Well, this is true, but because of some bug, when you connect to the Time Capsule, you don't see the sparse bundle file. And I got inconsistent results, for the WD NAS, double-clicking on the sparse bundle did nothing. For the Time Capsule, it did work.
At this point, I had to leave the location where the backup was present, and I only had remote SSH access. You know, if you can't solve a problem, let's complicate things by restrict yourself in solutions.
Finally, I tried to check out some data forensics blogs, and besides some expensive tools, I could find the solution.
The best part of hdiutil is that you can provide the read-only flag to it. This can be very awesome when it comes to forensics acquisition.
To mount any NAS via SMB:
To mount a Time Capsule share via AFP:
And finally this command should do the job:
It is nice that you can provide read-only parameter.
If the backup was encrypted and you don't want to provide the password in a password prompt, use the following:
Note: if you receive the error "resource temporarily unavailable", probably another machine is backing up to the device
And now, you can find your backup disk under /Volumes. Happy restoring!
Probably it would have been quicker to either enable the remote GUI, or to physically travel to the system and login locally, but that would spoil the fun.Related news
The problem
1. I had an encrypted Time Machine backup which was not used for months2. This backup was not on an official Apple Time Capsule or on a USB HDD, but on a WD MyCloud NAS
3. I needed files from this backup
4. After running out of time I only had SSH access to the macOS, no GUI
The struggle
By default, Time Machine is one of the best and easiest backup solution I have seen. As long as you stick to the default use case, where you have one active backup disk, life is pink and happy. But this was not my case.As always, I started to Google what shall I do. One of the first options recommended that I add the backup disk to Time Machine, and it will automagically show the backup snapshots from the old backup. Instead of this, it did not show the old snapshots but started to create a new backup. Panic button has been pressed, backup canceled, back to Google.
Other tutorials recommend to click on the Time Machine icon and pressing alt (Option) key, where I can choose "Browse other backup disks". But this did not list the old Time Machine backup. It did list the backup when selecting disks in Time Machine preferences, but I already tried and failed that way.
YAT (yet another tutorial) recommended to SSH into the NAS, and browse the backup disk, as it is just a simple directory where I can see all the files. But all the files inside where just a bunch of nonsense, no real directory structure.
YAT (yet another tutorial) recommended that I can just easily browse the content of the backup from the Finder by double-clicking on the sparse bundle file. After clicking on it, I can see the disk image on the left part of the Finder, attached as a new disk.
Well, this is true, but because of some bug, when you connect to the Time Capsule, you don't see the sparse bundle file. And I got inconsistent results, for the WD NAS, double-clicking on the sparse bundle did nothing. For the Time Capsule, it did work.
At this point, I had to leave the location where the backup was present, and I only had remote SSH access. You know, if you can't solve a problem, let's complicate things by restrict yourself in solutions.
Finally, I tried to check out some data forensics blogs, and besides some expensive tools, I could find the solution.
The solution
Finally, a blog post provided the real solution - hdiutil.The best part of hdiutil is that you can provide the read-only flag to it. This can be very awesome when it comes to forensics acquisition.
To mount any NAS via SMB:
mount_smbfs afp://<username>@<NAS_IP>/<Share_for_backup> /<mountpoint>
To mount a Time Capsule share via AFP:
mount_afp afp://any_username:password@<Time_Capsule_IP>/<Share_for_backup> /<mountpoint>
And finally this command should do the job:
hdiutil attach test.sparsebundle -readonly
It is nice that you can provide read-only parameter.
If the backup was encrypted and you don't want to provide the password in a password prompt, use the following:
printf '%s' 'CorrectHorseBatteryStaple' | hdiutil attach test.sparsebundle -stdinpass -readonly
Note: if you receive the error "resource temporarily unavailable", probably another machine is backing up to the device
And now, you can find your backup disk under /Volumes. Happy restoring!
Probably it would have been quicker to either enable the remote GUI, or to physically travel to the system and login locally, but that would spoil the fun.Related news
- Hacker Techniques Tools And Incident Handling
- Pentest Tools For Mac
- Growth Hacker Tools
- Hacking Tools Mac
- How To Make Hacking Tools
- Hacker Tool Kit
- Hacking Apps
- Pentest Tools List
- Hack Tools Download
- Hacking Tools Mac
- Pentest Tools Framework
- Pentest Tools Framework
- Pentest Tools Open Source
- Hacking Tools Github
- Hacking Tools Pc
- Best Pentesting Tools 2018
- Install Pentest Tools Ubuntu
- Hack Tools For Games
- Hacking Tools For Pc
- Hack Rom Tools
- World No 1 Hacker Software
- Hack Tool Apk No Root
- Bluetooth Hacking Tools Kali
- Hack Rom Tools
- Pentest Tools For Windows
- Hacking Tools For Pc
- Best Hacking Tools 2019
- Free Pentest Tools For Windows
- Hacking Tools For Pc
- Pentest Tools For Mac
- Hacking Tools Usb
- Hacking App
- Termux Hacking Tools 2019
- Hacking Tools For Windows 7
- Bluetooth Hacking Tools Kali
- Free Pentest Tools For Windows
- Termux Hacking Tools 2019
- Hacking App
- Hacking Tools For Windows 7
- Usb Pentest Tools
- Hack Tool Apk
- Hacker Tools Free
- Hacker Tools Windows
- Pentest Tools Website Vulnerability
- Pentest Tools Windows
- Hacker Tools Windows
- Hack Rom Tools
- Best Hacking Tools 2019
- Hacker Hardware Tools
- Hack Tool Apk No Root
- Hacking Tools Kit
- Hacking Tools For Games
- Termux Hacking Tools 2019
- Hacker Tools Software
- Hacker Tools For Windows
- Pentest Automation Tools
- Hack Website Online Tool
- Hacking Tools For Windows 7
- Hack Tools For Games
- Hacking Tools And Software
- Computer Hacker
- Top Pentest Tools
- Easy Hack Tools
- Pentest Tools Github
- Hacking Apps
- Hacker Tools Github
- Hacker Techniques Tools And Incident Handling
- Hacker Techniques Tools And Incident Handling
- Hacker Tools Hardware
- Kik Hack Tools
- Physical Pentest Tools
- Pentest Tools Find Subdomains
- Hacker Tools Free
- Pentest Tools Android
- Hack Tools Online
- Hackrf Tools
- Pentest Tools Nmap
- Easy Hack Tools
- Pentest Tools For Mac
- Pentest Tools Review
- What Are Hacking Tools
- Blackhat Hacker Tools
- Nsa Hack Tools
- Pentest Tools Framework
- Hacker Tools 2019
- Hacking Tools Name
- Pentest Tools Review
- Termux Hacking Tools 2019
- Computer Hacker
- Pentest Tools For Windows
- Hack Apps
- Hacking Tools Software
- Hack Tools For Games
- Hack Website Online Tool
- Pentest Tools Android
- Hacking Tools Usb
- Usb Pentest Tools
- Pentest Tools Port Scanner
- Hacking Tools 2020
- Hack Tools For Windows
- Hacking Tools Windows 10
- How To Hack
- Hacker Tools Apk Download
- Hack App
- Hacker Tools For Windows
- Tools Used For Hacking
- Pentest Tools Website Vulnerability
- Hacker Techniques Tools And Incident Handling
- Nsa Hack Tools
- Game Hacking
- Hack Tools For Games
- Hacking Tools
- Pentest Tools Port Scanner
Comments