Test a list of passwords on Sparse Image

I have a sparse image file with some important data in it I would like to retrieve. The only problem is I've forgotten the password.

I have a good idea of the parts of the password and managed to generate a 3000 line file with a list of possible passwords.

I would like to know how I can test these against my image. A few years ago, I had found a handy open source app with a simple GUI which did this, but I can't seem to find it. Maybe someone knows what app I'm talking about. Otherwise, if anyone knows an other method to do this (perhaps with automator), it would be great.

Thanks

The hdiutil command combined with a bit of bash scripting can accomplish what you're looking for. You'll need a plain text file with each password on a separate line, ending with a blank line.

1. Copy and paste this into a text file:

   #!/bin/bash
   
   while read line
   do
       echo -n "$line" | hdiutil attach -quiet -stdinpass "$1"
       if [ $? -eq 0 ]; then
           echo "Password is $line"
           break
       fi
   done < "$2"
   

2. Save it and make it executable by running chmod +x /path/to/scriptfile in Terminal.

3. In Terminal, run /path/to/scriptfile /path/to/image.dmg /path/to/passwords.txt.
   • It will run until it successfully mounts the disk image, and will output the password that worked. In my tests, it took 1.3-1.6 seconds per password, so 3000 passwords may take around an hour, depending on your system (although it could be sooner depending on where the password is in the file).

That should do the trick. If you're curious how and why it works, read on.

Explanation

While loop

    while read line
    do
    […]
    done < "$2"

This loops over each line in the password file (which is fed in via the < "$2" part) and executes the stuff between do and done each time it loops. $2 is a special variable in Bash that represents the second argument passed to the script (i.e. if you ran ./foo bar blah, $2 would be blah). It's enclosed in quotes in case there are any spaces or other characters in the name that could cause problems for Bash.

Mounting the image

hdiutil attach -quiet -stdinpass "$1"`

This is the command to actually mount the disk image (which we get from the command line arguments via the $1 variable, just like the password file). The -quiet flag means don't print any output (just to keep things tidy), and -stdinpass means get the password from the command line, not the usual OS X password dialog.

echo -n "$line"

The echo command simply repeats the input it's given, which in this case is an individual line from the password file, from the $line variable (which is again quoted in case the passwords contain special characters). The -n flag is the final piece of this puzzle, it prevents echo from repeating the newline character, which would be included in the password (and thus prevent even the correct password from working).

We use echo with a "pipe" (|) to send hdiutil the password. A pipe sends the output of the preceding command (echo) to the command after the pipe (hdiutil). This way rather than asking us for the password, hdiutil simply takes the text we read from the file.

Checking if the password was successful

if [ $? -eq 0 ]

This checks if the previous command was successful, by checking its exit code. The $? is another special variable that stores the exit code of the previous operation.

If the exit code is 0 (no errors), then we know that the password worked, and the if statement runs these lines:

    echo "Password is $line"
    break

This displays a simple message telling the user what the successful password is, then the break command exits the while loop and ends the program. We do this because the script would otherwise continue until it's checked every password in the file.

Combining all these pieces together gives you a convenient way of automating an otherwise long and painful task.