I transferred my entire iPhone to a newer model, then erased the old phone before discovering that the new one was faulty. Because the old phone cannot run the newer iOS version, I could not restore the backup back onto it. I returned the faulty replacement and now only have an encrypted iPhone backup stored on a Windows PC.
The problem is that I cannot remember the backup password. I have manually tried every password I can think of and tested more than 46,000 variations with hashcat, including combinations generated from my password manager. I suspect I may have accidentally mistyped one of my usual passwords when creating the backup, but I have no idea how to narrow down the possibilities.
The backup contains photos covering roughly 18 years, including family events, our wedding and honeymoon, holidays, and photos of pets. Some are stored elsewhere, and I am trying to recover others from old messages and accounts, but many may exist only in this backup. An earlier SSD failure also destroyed some older Apple backup files and left them without useful manifests.
Is there any legitimate way to recover the photos or reset the encrypted-backup password, or is carefully guessing the password my only option?
3 Answers
Keep an untouched copy of the backup in case you remember the password later, but be realistic about brute-forcing it. If your guesses are based on a typo, focus on likely keyboard mistakes, capitalization changes, missing or duplicated characters, and date or number substitutions rather than generating every possible combination. Beyond that, there is no supported way to extract only the photos from a properly encrypted backup.
Also check whether iCloud Photos was enabled when the backup was made. Photos already synchronized with iCloud generally are not duplicated inside the device backup, so signing into the correct Apple account and checking iCloud Photos could recover at least some of them. If iCloud only contains newer pictures, then the older ones may indeed exist only in the encrypted backup or in copies sent through other services.
Unfortunately, an encrypted iPhone backup cannot be opened or have its password reset without the original password. The encryption is specifically designed to prevent bypassing it, so password recovery tools can only test guesses. If the backup was made on a Mac, it may be worth checking Keychain Access for an entry related to an iOS or iPhone backup. On Windows, check any password-manager history, notes, old exported settings, and drive images from around the time the backup was created.
I checked iCloud and it only contains photos taken after the backup was saved to the PC. I am also trying to recover older images from message archives, but that will not cover everything. For now I am preserving the backup and continuing to think through possible password typos and variations.