Can AppleScript be used to brute force a FileVault drive where the password is lost? I make a terrible mistake. I totally lost my paper with the secret password for my encrypted external GUID hard drive. This external drive contains many pictures but also some works documents very usefull. So it would be very interesting for me to get through this password.

I can remember maybe 50% of my password.I calculated that with the known part of my password I will have a maximum of 250 000 possible combination. A program like crunch could do the list of all the combination but I think it is not the most difficult part of this mission.

I have to build a small program to fill the dialog box and trying all the 250 000 combination. I already tried to do this with Apple Script but I didn’t found the command to fill in the combination in the dialog box “Enter a password to unlock the disk”. This dialog box appear when we plug the disk to the mac.

Does somebody know well applescript to helping me to interact with this unlocker disk dialog box? Or maybe somebody have an other solution to unlock it without applescript?

If somebody is interested to helping me I will be very grateful.
As a proof of concept, I formatted a USB Thumb-drive using a GUID Partition Map and formatted it Mac OS Extended (Journaled) naming it "Encrypted".

Then in Finder, I selected the disk named "Encrypted" and control-clicked selecting Encrypt "Encrypted"..., while setting its password to "password".

When it was done encrypting, using Terminal, I ascertained the UUID I'd need to use with the diskutil command in my script with the following command: diskutil cs list

I wanted the UUID of the Logical Volume where it showed Volume Name: Encrypted and in this case it showed it as:

Logical Volume 1BFD0C99-1A67-4DC2-A0F4-199B2AE635B0


Here's the output of diskutil cs list, so as to see from what I drew the UUID.

$ diskutil cs list
CoreStorage logical volume groups (1 found)
|
+-- Logical Volume Group 3D8D6165-909C-4C55-8C0B-811AC4856773
    =========================================================
    Name:         Encrypted
    Status:       Online
    Size:         15270830080 B (15.3 GB)
    Free Space:   16777216 B (16.8 MB)
    |
    +-&lt; Physical Volume 1E6C582B-5822-4986-9F41-164DE662FCE1
    |   ----------------------------------------------------
    |   Index:    0
    |   Disk:     disk2s2
    |   Status:   Online
    |   Size:     15270830080 B (15.3 GB)
    |
    +-&gt; Logical Volume Family 6D7E4DCE-D7C5-4383-BF88-9E2DB9A52E14
        ----------------------------------------------------------
        Encryption Status:       Unlocked
        Encryption Type:         AES-XTS
        Conversion Status:       Complete
        Conversion Direction:    -none-
        Has Encrypted Extents:   Yes
        Fully Secure:            Yes
        Passphrase Required:     Yes
        |
        +-&gt; Logical Volume 1BFD0C99-1A67-4DC2-A0F4-199B2AE635B0
            ---------------------------------------------------
            Disk:               disk3
            Status:             Online
            Size (Total):       14935281664 B (14.9 GB)
            Size (Converted):   -none-
            Revertible:         Yes (unlock and decryption required)
            LV Name:            Encrypted
            Volume Name:        Encrypted
            Content Hint:       Apple_HFS
$ 


With now having the correct UUID, I created my bash script in Terminal:

touch unlock
open unlock


I then added the following code:

#!/bin/bash

if [[ ! -z $1 ]]; then
    while read -r line; do
        printf "   Testing: $line \n"
        diskutil coreStorage unlockVolume 1BFD0C99-1A67-4DC2-A0F4-199B2AE635B0 -passphrase "$line" 2&gt;/dev/null
            if [[ $? -eq 0 ]]; then
                printf "\n   The correct password is: $line \n\n"
                exit 0
            fi
    done &lt; "$1"
else
    printf "\n   Missing Dictionary File!...\n\n   Syntax: ./unlock dictionary.txt\n\n"
    exit 1
fi


Note: Replace the UUID above with the UUID of the Logical Volume of your encrypted drive.



I saved and closed the script named "unlock" and made it executable using:

chmod u+x unlock


I then created a dictionary file, touch dictionary.txt and populated the file.  Of course in your case, you'd use as you mentioned the program named crunch to create your dictionary file(s).

I then ejected and remove the USB Thumb-drive from my system.

I then plugged in the USB Thumb-drive and when the "Enter a password to unlock the disk "Encrypted"." dialog box appeared, I clicked the Cancel button.

Now I was ready to unlock it using the bash script and dictionary.txt file from Terminal.

To show what I put in the dictionary.txt file:

$ cat dictionary.txt
p
pa
pass
passw
password
passwo
passwor
$ 


Here's the output of: ./unlock dictionary.txt

$ ./unlock dictionary.txt
   Testing: p 
Started CoreStorage operation
   Testing: pa 
Started CoreStorage operation
   Testing: pass 
Started CoreStorage operation
   Testing: passw 
Started CoreStorage operation
   Testing: password 
Started CoreStorage operation
Logical Volume successfully unlocked
Logical Volume successfully attached as disk3
Logical Volume successfully mounted as /Volumes/Encrypted
Core Storage disk: disk3
Finished CoreStorage operation

   The correct password is: password 

$


As you can see it tried what was in the dictionary.txt file up until if found the correct password and when the correct password was tested it unlocked and mounted the disk, prints out what the correct password was and exits the script.

The reason for printing out all passwords, is so if you need to stop the script you can then remove the tried passwords from the dictionary.txt file before starting again.

Note:  It is important that before running the bash script you have first freshly plugged in the drive and clicked the Cancel button, then run the script.