search

hackappcom / iloot

OpenSource tool for iCloud backup extraction
https://hackapp.com/
637 stars 201 forks source link

Failed to unwrap file key for file error #12

Closed lordm closed 8 years ago

lordm commented 9 years ago

The tool is working perfectly, but this time there's a file that is doesn't download correctly and gives me Failed to unwrap file key for file Documents/ChatStorage.sqlite !!! What does the error mean ? and how can it be fixed ?

hackappcom commented 9 years ago

Hi, it means, that this file is encrypted, and somehow, we can't get decryption key for it. Which application owns this file?

g9rga commented 9 years ago

I have the same error with file Library/Safari/Bookmarks.db

g9rga commented 9 years ago

Here is some debug info: Uuid_hex: 08562c09f9684938ba4c712ebe070ef9 Encryption_keyhex: acb9313fe7e0460e9e346693622b31150000000000ce6ca80000000300000001000000481ddcd16b4b4291aab21c1d1974287b21816035465940183c7f5fa564b0da766a96fd9f1ce43bc3d292192fe4bcdc101a5e70ec33b8ff3ca81faddb129306dd0b0a27072f5bbbbc04 FileID: "\321\360b\342\332&\031*f%\331h\'K\375\250\320x!\344" Domain: "HomeDomain" RelativePath: "Library/Safari/Bookmarks.db" Signature: "\001\267\206\"\313+M\362fS\361\347\247\303\274\365/)\t{" Size: 651264 Attributes { KeybagID: 4 EncryptionKey: "\254\2711?\347\340F\016\2364f\223b+1\025\000\000\000\000\000\316l\250\000\000\000\003\000\000\000\001\000\000\000H\035\334\321kKB\221\252\262\034\035\031t({!\2015FY@\030<\177\245d\260\332vj\226\375\237\034\344;\303\322\222\031/\344\274\334\020\032^p\3543\270\377<\250\037\255\333\022\223\006\335\013\n\'\007/[\273\274\004" InodeNumber: 13528232 Mode: 33188 UserID: GroupID: LastModified: 1417015420 LastStatusChange: 1417015420 Birth: ProtectionClass: 3 EncryptionKeyVersion: 2 DecryptedSize: 651264 }

jetXS commented 9 years ago

got the same error for a lot of my files.

exemple: Failed to unwrap file key for file Media/Recordings/20141215 150555.waveform !!!

ghost commented 9 years ago

yep same here, a lot of failed to unwrap file key errors. It's definitely a decryption problem, both sms.db and notes is failing to decrypt. I'm guessing apple changed their encryption method.

rrover commented 9 years ago

This issue is happening again now, something changed to the encryption method?

g9rga commented 9 years ago

You have to check file protection level, if it's equal 3 (NSFileProtectionCompleteUntilFirstUserAuthentication) file can'not be decrypted now, because:

NSFileProtectionCompleteUntilFirstUserAuthentication - The file is stored in an encrypted format on disk and cannot be accessed until after the device has booted. After the user unlocks the device for the first time, your application can access the file and continue to access it even if the user subsequently locks the device.