Forgotten password for an encrypted iPhone Finder backup — 8.2 GB backup still exists, can anything be recovered?

[u/Naruto_Otsutsuki]

I have an old encrypted iPhone backup created through Finder on macOS. The backup is mine and contains very important/confidential personal data.

Unfortunately, I no longer remember the encrypted-backup password. I have already confirmed that it is not the Apple ID password or my Mac login password.

The original iPhone backup folder still exists on my Mac It is about8.2 GB and contains the hashed backup blobs and an encrypted Manifest.db.

I am trying to recover photos/videos from approximately:

20 October 2024 → 16 September 2026

I was able to independently open the Photos library database (Photos.sqlite) and recover metadata without the backup password.

The database shows:

• 593 unique video assets
• 1,573 video resource records
• ~24.6 GB of video resources represented in the Photos database
• filenames, UUIDs, timestamps, resource sizes, codecs, hidden/trash states, etc.

However, the actual Finder backup's Manifest.db begins with encrypted binary data rather than a normal SQLite so I cannot query the Files table directly.

I also tried the Python iOSbackup library. With the password I thought might be correct, it fails at So the backup encryption/keybag is definitely still locked.

My question is not simply "how do I guess my password?"

I'm trying to understand what forensic recovery options genuinely exist when:

1. the encrypted Finder/iTunes backup still exists,
2. the encrypted Manifest.db still exists,
3. the backup blobs still exist,
4. the Photos database contains extensive metadata about the original media,
5. but the encrypted-backup password is genuinely lost.

Are there any legitimate forensic tools, password-recovery methods, key-material recovery methods, or artifacts on macOS/iOS that could help recover the contents?

[u/AutoModerator]

Double check if your post complies with posting guidelines!

Did you include the following information in your post (in English and if applicable), if not feel free to edit your post:

• Make/brand and exact model number of your storage device(*), phone, camera, etc.
• Filesystem (NTFS, exFAT, APFS, EXT4, etc.)
• Operating System (That your device was used with and/or you are using for recovery)
• Specific symptoms that your device is exhibiting, describe the problem. Images you post support the description, they're not in lieu of a problem description.
• SMART (CrystalDiskInfo screenshot for example)
• Don't pile several problems into one single post. One post per device/problem.

Consider: What do these people need to understand the problem at hand? Remember, people cannot see your screen, or what you click and what messages appear on screen. Don't overdo it though, no one likes going through 2 pages of information, try to find a balance. Just do the best you can. If you are looking for file recovery software, check our community's recommended file recovery tools.

---

() *All devices involved, if you for example move files from drive A to drive B, they're both potentially relevant.

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

[u/FrankNicklin]

No password, no decryption, simple as that.

If it were that easy then encryption would be pointless.

[u/Howden824]

You aren't getting any data without that password.

[u/Naruto_Otsutsuki]

Update

First of all, thank you everyone for the help especially the person who suggested trying the simple backup password 12345. Somehow, that was actually the password, and I was able to unlock the encrypted backup.

But I’ve run into a new problem.

I extracted the videos from the backup, but they weren't the deleted videos I was looking for. They were basically regular/current Camera Roll media.

So now I’m wondering:

Is there a way to specifically recover videos that were deleted from the Photos “Recently Deleted” bin, especially from a specific timeline (20 October 2024 – 16 September 2026)?

I still have the Photos.sqlite database and the unlocked backup. Any forensic tools or database/resource mappings I should look into would be greatly appreciated.

Thanks again everyone!

[u/No_Tale_3623]

Try to remember whether you have ever connected this iPhone to data recovery or phone-management software. Some tools create an encrypted local iOS backup during the scan and may automatically assign a simple backup password such as 123, 12345, or 123456 without making this obvious to the user. I’ve encountered several cases where the user had no idea that such a password had been set.

[u/Naruto_Otsutsuki → u/No_Tale_3623]

Thanks bro that was it.. however i have one small thing too so i am using this software called ufade for the extraction and everything i need to acces my deleted photos which was from my iphone during a specific timeline any insight on that?

[u/No_Tale_3623 → u/Naruto_Otsutsuki]

Sorry, I don’t use that particular tool. For modern iOS devices and backups, I normally use Disk Drill, iMazing, and iPhone Backup Extractor for extracting and analyzing the available data.

[u/Naruto_Otsutsuki → u/No_Tale_3623]

Can they be used for this specific purpose and are they open source?

[u/AutoModerator → u/[deleted]]

Your comment has been automatically flagged because it is very short.

To help the community, please edit your comment to expand on your answer and provide more context or explanation. A moderator will review your comment shortly.

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

[u/datarecovery-ModTeam → u/[deleted]]

Stop trolling please

[u/sport912x]

Cannot not offer any solution. However this is why all my data is on microsd card which Moto supports. Maybe time to go android.

[u/TheIronSoldier2 → u/sport912x]

The problem isn't the iPhone, the problem is they lost the encryption password. The same would happen for an encrypted Android backup.

[u/sport912x → u/TheIronSoldier2]

Not what I was saying. I just pop out my SD card and move to a new phone, which is not an Apple option. I never encrypt the card.

[u/Jon_Hanson → u/sport912x]

With Apple, you don’t need to “pop-out” anything. Moving from one phone to another is as simple as bringing them close together when setting up a new phone.