Dumpkeychain is a Windows command-line utility for decrypting credentials from Mac OS X system and user keychains given the associated system-key-file or keychain-password respectively. Mac OS X user keychains often contain many Internet account passwords login credentials and secure notes. The system keychain contains Wi-Fi passwords and other shared credentials.

The application has been tested/developed under Windows 7 using keychain data from Mac OS X 10.8 Mountain Lion and the developers' preview of Mac OS X 10.9 Mavericks. Output is to a user-nominated text file. This version of the application fixes a bug when parsing keychain-tables containing unused record-pointers. It also adds the ability to output the created and last-modified timestamps for each record that has them.

This script was developed for use in EnCase training. For more details, please click the following link:

• OpenText EnCase Training