Need help decryptin Itunes backup linux!?

[P3T3]

I am using bellow tut with ios 9.2, decipt it but
but when I get to bellow part it just errors

echo | python iphone-dataprotection/python_scripts/keychain_tool.py \
-d outdir/keychain-backup.plist outdir/Manifest.plist | less -S

any help with above cmd please as get script error with cripto not found but its there!!

$ hg clone https://code.google.com/p/iphone-dataprotection/
$ python iphone-dataprotection/python_scripts/backup_tool.py \
~/Library/Application\ Support/MobileSync/Backup/long-hex-string \
outdir
Device Name : My iPhone
Display Name : My iPhone
Last Backup Date : 2012-12-09 16:00:18
IMEI : 565988269232005
Serial Number : LN1G2AIND69G
Product Type : iPhone4,1
Product Version : 6.0.1
iTunes Version : 11.0
Extract backup to outdir ? (y/n)
y
Backup is encrypted
Enter backup password :
*******************
Writing Documents/products/97266p_bifold_3.jpg
...
...
...
Writing Media/DCIM/103APPLE/IMG_3874.JPG
You can decrypt the keychain using the following command :
python keychain_tool.py -d outdir/keychain-backup.plist outdir/Manifest.plist
The great thing about encrypted iPhone backups is that they contain things like WiFi passwords that aren’t in regular unencrypted backups. As discussed in the iOS Security Whitepaper, encrypted backups are considered more “secure,” so Apple considers it ok to include more sensitive information in them. And, after backup_tool finishes, we can use decryption to get the sensitive information back in plaintext:

$ # You’ll need to install the M2Crypto library before keychain_tool
$ # will work. These commands may be all you need:
$ brew install swig
...
$ pip install --user M2Crypto
...
$ echo | python iphone-dataprotection/python_scripts/keychain_tool.py \
-d outdir/keychain-backup.plist outdir/Manifest.plist | less -S

If you have key835 for device 14b826ee48c5ea8b617f62fe12040c2d09af6b46 enter it (in hex)
--------------------------------------------------------------------------------------
| Passwords |
-----------------------------------------------------------------------------------
|Service |Account |Data |Access group |Protection class|
--------------------------------------------------------------------------------------
|******* |Ed’s Coffee Shop |<3FrenchRoast |apple |AfterFirstUnlock|
...
An important warning: obviously, decrypting your iOS device’s backup removes its encryption. To protect your privacy and security, you should only run these scripts on a machine with full-disk encryption. While it is possible for a security expert to write software that protects keys in memory, e.g. by using functions like VirtualLock() and SecureZeroMemory() among many other things, these Python scripts will store your encryption keys and passwords in strings to be garbage-collected by Python. This means your secret keys and passwords will live in RAM for a while, from whence they will leak into your swap file and onto your disk, where an adversary can recover them. This completely defeats the point of having an encrypted backup.

[ribbentrop]

Why do you need it in Linux? Don't you have a normal, Win based PC?

[P3T3]

Yes but I read the keybag part im stuck on only works on osx and linux...

[ribbentrop]

If you are learning how to work with Linux, it's a one point... But if you want just decrypt backup, it's another one. It can be done in more easy way on Win PC.

[P3T3]

I know linux no issues there,
Trying to decryption to get Icloud ac for phone I have locked hear...
I dont have 800 for forensic sweet and thread where people where decrying has gone!?!
Any help would be good!

[ChelasGsm]

Send me backup on message

[P3T3]

Still stuck, I have decripted backup days ago, reading keybag is where I am stuck!

[P3T3]

Ok fixed all that but script errors, any one get me Icloud details from this backup?

[Y0ussef12]

is there any solution to decrypt iphone backup password cause i lost mine and thanks

[Y0ussef12]

i have a jailbrocken ipad is there any way to retrive the backup password ?? thanks for helping

[P3T3]

Yes there is but not fixed script errors, only other way costs 800 for a license

[Y0ussef12]

800 its to much for decrypt

[ribbentrop]

Who knows, may be you set password like "askjfhac1234C-9)))(((123njfhdhd"
Bruteforce attack on your password will take too much time...

[P3T3]

Originally Posted by Y0ussef12

800 its to much for decrypt

Brute force for pass to unlock backup, then you can extract in windows..
I am not trying to do this I want to decrypt to keybag but not needed as the Icloud password is disabled!