0

A friend's husband died suddenly a few months ago. He did not leave his password. The iMac (Big Sur) has many important documents and photos and the wife would like to recover them. She has her own iMac and they may use the same Apple ID or a family ID.

I started the computer and it came up with three accounts, all variations of his name. One or more must be admin accounts. I tried likely passwords on one of the accounts with no luck but decided that repeated wrong passwords may lock the account.

Question 1: Is there a limit on how many wrong passwords can be used before the account is locked? If so, how long is it locked before you can try again?

A document from Apple says that you can login using your Apple ID and password. Apparently, after a few attempts, it will display a question mark with allows the Apple ID to be used. In this case, no question mark appeared. This could mean no Apple ID or a different Apple ID attached to the account.

I booted into recovery mode and tried to reset the passwords using resetpassword. It displays the three accounts, saying something like "Choose an admin account to reset password".

Question 2: Does the fact it is displaying three accounts mean they are all admin accounts given that it explicitly says to choose an admin account?

I reset the password for one of the accounts, rebooted and tried to login. It did not allow me to login.

Question 3: What may have caused the password reset not to work?

I booted into single user mode and tried to mount the disk using mnt -uw /. It gave an error which I cannot remember.

Question 4: Is this likely to mean that Filevault is enabled? :-( What error would it give if it was Filevault?

If I successfully reset the password for an admin account, when I login, it will want to know the password to the keychain. Since that is the unknown password, the only option will be to reset the keychain which will lose all passwords.

Question 5: Is the Filevault password stored in the keychain? If so, will I lose access to the encrypted disk by resetting the keychain?

It is likely that keychain is synced to iCloud.

Question 6: Is there any way to access the keychain from iCloud so as to be able to retrieve passwords?

So in short, I am trying to identify a process that will allow me to access the files on the disk without making any dreadful mistakes that lose everything.

Graham Miln
  • 43,776
David M
  • 89
  • I've linked to two similar questions at the top of your post. If the answers there don't help you (or you run into issues applying them), please ask a new question specifically for one specific problem you face. – nohillside Jul 21 '22 at 08:16
  • Also, https://support.apple.com/en-us/HT208510 might help if your friend needs access to their husband's iCloud account. – nohillside Jul 21 '22 at 08:17
  • The problem is that I have already looked into those other approaches which are for simple problems, ie, changing password. But that does not address the question of losing the keychain and therefore whether an encrypted disk becomes unrecoverable. It is the coordination of the various approaches so as not to lose the data that I am concerned about. Changing the password without considering these issues could lose the data. Some bits could be split out, but it is the big picture I am concerned about. – David M Jul 23 '22 at 07:35
  • 1
    I would also add that referring people to ten year old posts when the operating systems have changed dramatically since then is not helpful. Techniques useful then do not work in today's security-conscious world. – David M Jul 23 '22 at 07:43
  • I understand this. But please post a focused question then, posts including several questions will always be put on hold/get closed. – nohillside Jul 23 '22 at 08:40

0 Answers0