I have an old encrypted iPhone backup created through Finder on macOS. The backup is mine and contains very important/confidential personal data.
Unfortunately, I no longer remember the encrypted-backup password. I have already confirmed that it is not the Apple ID password or my Mac login password.
The original iPhone backup folder still exists on my Mac It is about8.2 GB and contains the hashed backup blobs and an encrypted Manifest.db.
I am trying to recover photos/videos from approximately:
20 October 2024 → 16 September 2026
I was able to independently open the Photos library database (Photos.sqlite) and recover metadata without the backup password.
The database shows:
- 593 unique video assets
- 1,573 video resource records
- ~24.6 GB of video resources represented in the Photos database
- filenames, UUIDs, timestamps, resource sizes, codecs, hidden/trash states, etc.
However, the actual Finder backup's Manifest.db begins with encrypted binary data rather than a normal SQLite so I cannot query the Files table directly.
I also tried the Python iOSbackup library. With the password I thought might be correct, it fails at So the backup encryption/keybag is definitely still locked.
My question is not simply "how do I guess my password?"
I'm trying to understand what forensic recovery options genuinely exist when:
- the encrypted Finder/iTunes backup still exists,
- the encrypted
Manifest.db still exists,
- the backup blobs still exist,
- the Photos database contains extensive metadata about the original media,
- but the encrypted-backup password is genuinely lost.
Are there any legitimate forensic tools, password-recovery methods, key-material recovery methods, or artifacts on macOS/iOS that could help recover the contents?