mac_keychain_volatility

$ python vol.py -f applemail.mem --profile=MacLion_10_7_3_AMDx64 mac_list_files > mail.files.txt
Volatility Foundation Volatility Framework 2.4 (Beta)

$ grep login.keychain mail.files.txt
0xffffff800e4ef9b0 /Macintosh HD/Users/acase/Library/Keychains/login.keychain.sb-ad335571-h1adIf/..namedfork/rsrc
0xffffff800adb44d8 /Macintosh HD/Users/acase/Library/Keychains/login.keychain

$ python vol.py -f applemail.mem --profile=MacLion_10_7_3_AMDx64 mac_dump_file -q 0xffffff800adb44d8 -O login.keychain.0xffffff800adb44d8
Volatility Foundation Volatility Framework 2.4 (Beta)
Wrote 32768 bytes to login.keychain.0xffffff800adb44d8 from vnode at address ffffff800adb44d8


$ python vol.py -f applemail.mem --profile=MacLion_10_7_3_AMDx64 mac_keychaindump
Volatility Foundation Volatility Framework 2.4 (Beta)
Possible Keys
-------------
0000001022A4EE7CC9F7C56F7E54BA66BEC7E017FC070050
E935983D94D5E995AC6A618203BA61FB53151F1BE672AFCB
E935983D94D5E995AC6A618203BA61FB53151F1BE672AFCB
602FE30401000000E4ADD97B010000B0982FE30401000000
E935983D94D5E995AC6A618203BA61FB53151F1BE672AFCB
000000000000000000000000000000000000000000000000
0E783B792E704C8F9D36D3A5810AA3B4B406E095CC13931C
0E783B792E704C8F9D36D3A5810AA3B4B406E095CC13931C
E935983D94D5E995AC6A618203BA61FB53151F1BE672AFCB
923A8A18D2C26373FE4AD3E0FC5F398181424F9B7115CF10
5501B98B107204AE78511E0BD9B13E93C3C8EBD9660740FE
0B01D227FC0700907215D227FC0700D002001F1BE672AFCB
000000000000000000000000000000000000000000000000
0300000000000000000000000000000000000000C27F0000

$ python chainbreaker.py -i login.keychain.0xffffff800adb44d8 -k 0E783B792E704C8F9D36D3A5810AA3B4B406E095CC13931C | strings
[+] Generic Password Record
 [-] RecordSize : 0x000000d8
 [-] Record Number : 0x00000000
 [-] SECURE_STORAGE_GROUP(SSGP) Area : 0x0000002c
 [-] Create DateTime: 20120321171408Z
 [-] Last Modified DateTime: 20120321171408Z
 [-] Description :
 [-] Creator : aapl
 [-] Type :
 [-] PrintName : AppleID
 [-] Alias :
 [-] Account : xxxxx@yyyyyy.com
 [-] Service : AppleID
 [-] Password
00000000:  XX XX XX XX XX XX XX XX XX                       youwish!
[+] Generic Password Record
 [-] RecordSize : 0x000000e0
 [-] Record Number : 0x00000003
 [-] SECURE_STORAGE_GROUP(SSGP) Area : 0x00000024
 [-] Create DateTime: 20140502022715Z
 [-] Last Modified DateTime: 20140502022715Z
 [-] Description :
 [-] Creator :
 [-] Type :
 [-] PrintName : GnuPG
 [-] Alias :
 [-] Account : XXXXXXXXXXXXXXXXXXXXXX
 [-] Service : GnuPG
 [-] Password
00000000:  62 6F 6F 6D                                        boom
[+] Internet Record
 [-] RecordSize : 0x0000010c
 [-] Record Number : 0x00000001
 [-] SECURE_STORAGE_GROUP(SSGP) Area : 0x0000002c
 [-] Create DateTime: 20140502014644Z
 [-] Last Modified DateTime: 20140502014644Z
 [-] Description :
 [-] Comment :
 [-] Creator :
 [-] Type :
 [-] PrintName : smtp.gmail.com
 [-] Alias :
 [-] Protected :
 [-] Account : xxxxxxxxx@gmail.com
 [-] SecurityDomain :
 [-] Server : smtp.gmail.com
 [-] Protocol Type : kSecProtocolTypeSMTP
 [-] Auth Type : kSecAuthenticationTypeDefault
 [-] Port : 587
 [-] Path :
 [-] Password
00000000:  61 6C 6C 41 642 79 33 32  33 33 32 33             allABy323323