To use a keyboard shortcut, press and hold one or more modifier keys and then press the last key of the shortcut. For example, to use Command-C (copy), press and hold the Command key, then the C key, then release both keys. Mac menus and keyboards often use symbols for certain keys, including modifier keys:
Mike was finally ready for happiness. After everything he had been through with Rebecca, he was finally ready to turn the page and start a life with the only woman who ever held his heart. He and Jade were getting married. They were going to have twins. We would like to show you a description here but the site won't allow us.
On keyboards made for Windows PCs, use the Alt key instead of Option, and the Windows logo key instead of Command.
Some keys on some Apple keyboards have special symbols and functions, such as for display brightness , keyboard brightness , Mission Control, and more. If these functions aren't available on your keyboard, you might be able to reproduce some of them by creating your own keyboard shortcuts. To use these keys as F1, F2, F3, or other standard function keys, combine them with the Fn key.
Cut, copy, paste, and other common shortcuts
- Command-X: Cut the selected item and copy it to the Clipboard.
- Command-C: Copy the selected item to the Clipboard. This also works for files in the Finder.
- Command-V: Paste the contents of the Clipboard into the current document or app. This also works for files in the Finder.
- Command-Z: Undo the previous command. You can then press Shift-Command-Z to Redo, reversing the undo command. In some apps, you can undo and redo multiple commands.
- Command-A: Select All items.
- Command-F: Find items in a document or open a Find window.
- Command-G: Find Again: Find the next occurrence of the item previously found. To find the previous occurrence, press Shift-Command-G.
- Command-H: Hide the windows of the front app. To view the front app but hide all other apps, press Option-Command-H.
- Command-M: Minimize the front window to the Dock. To minimize all windows of the front app, press Option-Command-M.
- Command-O: Open the selected item, or open a dialog to select a file to open.
- Command-P: Print the current document.
- Command-S: Save the current document.
- Command-T: Open a new tab.
- Command-W: Close the front window. To close all windows of the app, press Option-Command-W.
- Option-Command-Esc: Force quit an app.
- Command–Space bar: Show or hide the Spotlight search field. To perform a Spotlight search from a Finder window, press Command–Option–Space bar. (If you use multiple input sources to type in different languages, these shortcuts change input sources instead of showing Spotlight. Learn how to change a conflicting keyboard shortcut.)
- Control–Command–Space bar: Show the Character Viewer, from which you can choose emoji and other symbols.
- Control-Command-F: Use the app in full screen, if supported by the app.
- Space bar: Use Quick Look to preview the selected item.
- Command-Tab: Switch to the next most recently used app among your open apps.
- Shift-Command-5: In macOS Mojave or later, take a screenshot or make a screen recording. Or use Shift-Command-3 or Shift-Command-4 for screenshots. Learn more about screenshots.
- Shift-Command-N: Create a new folder in the Finder.
- Command-Comma (,): Open preferences for the front app.
Sleep, log out, and shut down shortcuts
You might need to press and hold some of these shortcuts for slightly longer than other shortcuts. This helps you to avoid using them unintentionally.
- Power button: Press to turn on your Mac or wake it from sleep. Press and hold for 1.5 seconds to put your Mac to sleep.* Continue holding to force your Mac to turn off.
- Option–Command–Power button* or Option–Command–Media Eject : Put your Mac to sleep.
- Control–Shift–Power button* or Control–Shift–Media Eject : Put your displays to sleep.
- Control–Power button* or Control–Media Eject : Display a dialog asking whether you want to restart, sleep, or shut down.
- Control–Command–Power button:* Force your Mac to restart, without prompting to save any open and unsaved documents.
- Control–Command–Media Eject : Quit all apps, then restart your Mac. If any open documents have unsaved changes, you will be asked whether you want to save them.
- Control–Option–Command–Power button* or Control–Option–Command–Media Eject : Quit all apps, then shut down your Mac. If any open documents have unsaved changes, you will be asked whether you want to save them.
- Control-Command-Q: Immediately lock your screen.
- Shift-Command-Q: Log out of your macOS user account. You will be asked to confirm. To log out immediately without confirming, press Option-Shift-Command-Q.
* Does not apply to the Touch ID sensor.
Finder and system shortcuts
- Command-D: Duplicate the selected files.
- Command-E: Eject the selected disk or volume.
- Command-F: Start a Spotlight search in the Finder window.
- Command-I: Show the Get Info window for a selected file.
- Command-R: (1) When an alias is selected in the Finder: show the original file for the selected alias. (2) In some apps, such as Calendar or Safari, refresh or reload the page. (3) In Software Update preferences, check for software updates again.
- Shift-Command-C: Open the Computer window.
- Shift-Command-D: Open the desktop folder.
- Shift-Command-F: Open the Recents window, showing all of the files you viewed or changed recently.
- Shift-Command-G: Open a Go to Folder window.
- Shift-Command-H: Open the Home folder of the current macOS user account.
- Shift-Command-I: Open iCloud Drive.
- Shift-Command-K: Open the Network window.
- Option-Command-L: Open the Downloads folder.
- Shift-Command-N: Create a new folder.
- Shift-Command-O: Open the Documents folder.
- Shift-Command-P: Show or hide the Preview pane in Finder windows.
- Shift-Command-R: Open the AirDrop window.
- Shift-Command-T: Show or hide the tab bar in Finder windows.
- Control-Shift-Command-T: Add selected Finder item to the Dock (OS X Mavericks or later)
- Shift-Command-U: Open the Utilities folder.
- Option-Command-D: Show or hide the Dock.
- Control-Command-T: Add the selected item to the sidebar (OS X Mavericks or later).
- Option-Command-P: Hide or show the path bar in Finder windows.
- Option-Command-S: Hide or show the Sidebar in Finder windows.
- Command–Slash (/): Hide or show the status bar in Finder windows.
- Command-J: Show View Options.
- Command-K: Open the Connect to Server window.
- Control-Command-A: Make an alias of the selected item.
- Command-N: Open a new Finder window.
- Option-Command-N: Create a new Smart Folder.
- Command-T: Show or hide the tab bar when a single tab is open in the current Finder window.
- Option-Command-T: Show or hide the toolbar when a single tab is open in the current Finder window.
- Option-Command-V: Move the files in the Clipboard from their original location to the current location.
- Command-Y: Use Quick Look to preview the selected files.
- Option-Command-Y: View a Quick Look slideshow of the selected files.
- Command-1: View the items in the Finder window as icons.
- Command-2: View the items in a Finder window as a list.
- Command-3: View the items in a Finder window in columns.
- Command-4: View the items in a Finder window in a gallery.
- Command–Left Bracket ([): Go to the previous folder.
- Command–Right Bracket (]): Go to the next folder.
- Command–Up Arrow: Open the folder that contains the current folder.
- Command–Control–Up Arrow: Open the folder that contains the current folder in a new window.
- Command–Down Arrow: Open the selected item.
- Right Arrow: Open the selected folder. This works only when in list view.
- Left Arrow: Close the selected folder. This works only when in list view.
- Command-Delete: Move the selected item to the Trash.
- Shift-Command-Delete: Empty the Trash.
- Option-Shift-Command-Delete: Empty the Trash without confirmation dialog.
- Command–Brightness Down: Turn video mirroring on or off when your Mac is connected to more than one display.
- Option–Brightness Up: Open Displays preferences. This works with either Brightness key.
- Control–Brightness Up or Control–Brightness Down: Change the brightness of your external display, if supported by your display.
- Option–Shift–Brightness Up or Option–Shift–Brightness Down: Adjust the display brightness in smaller steps. Add the Control key to this shortcut to make the adjustment on your external display, if supported by your display.
- Option–Mission Control: Open Mission Control preferences.
- Command–Mission Control: Show the desktop.
- Control–Down Arrow: Show all windows of the front app.
- Option–Volume Up: Open Sound preferences. This works with any of the volume keys.
- Option–Shift–Volume Up or Option–Shift–Volume Down: Adjust the sound volume in smaller steps.
- Option–Keyboard Brightness Up: Open Keyboard preferences. This works with either Keyboard Brightness key.
- Option–Shift–Keyboard Brightness Up or Option–Shift–Keyboard Brightness Down: Adjust the keyboard brightness in smaller steps.
- Option key while double-clicking: Open the item in a separate window, then close the original window.
- Command key while double-clicking: Open a folder in a separate tab or window.
- Command key while dragging to another volume: Move the dragged item to the other volume, instead of copying it.
- Option key while dragging: Copy the dragged item. The pointer changes while you drag the item.
- Option-Command while dragging: Make an alias of the dragged item. The pointer changes while you drag the item.
- Option-click a disclosure triangle: Open all folders within the selected folder. This works only when in list view.
- Command-click a window title: See the folders that contain the current folder.
- Learn how to use Command or Shift to select multiple items in the Finder.
- Click the Go menu in the Finder menu bar to see shortcuts for opening many commonly used folders, such as Applications, Documents, Downloads, Utilities, and iCloud Drive.
Document shortcuts
The behavior of these shortcuts may vary with the app you're using.
- Command-B: Boldface the selected text, or turn boldfacing on or off.
- Command-I: Italicize the selected text, or turn italics on or off.
- Command-K: Add a web link.
- Command-U: Underline the selected text, or turn underlining on or off.
- Command-T: Show or hide the Fonts window.
- Command-D: Select the Desktop folder from within an Open dialog or Save dialog.
- Control-Command-D: Show or hide the definition of the selected word.
- Shift-Command-Colon (:): Display the Spelling and Grammar window.
- Command-Semicolon (;): Find misspelled words in the document.
- Option-Delete: Delete the word to the left of the insertion point.
- Control-H: Delete the character to the left of the insertion point. Or use Delete.
- Control-D: Delete the character to the right of the insertion point. Or use Fn-Delete.
- Fn-Delete: Forward delete on keyboards that don't have a Forward Delete key. Or use Control-D.
- Control-K: Delete the text between the insertion point and the end of the line or paragraph.
- Fn–Up Arrow: Page Up: Scroll up one page.
- Fn–Down Arrow: Page Down: Scroll down one page.
- Fn–Left Arrow: Home: Scroll to the beginning of a document.
- Fn–Right Arrow: End: Scroll to the end of a document.
- Command–Up Arrow: Move the insertion point to the beginning of the document.
- Command–Down Arrow: Move the insertion point to the end of the document.
- Command–Left Arrow: Move the insertion point to the beginning of the current line.
- Command–Right Arrow: Move the insertion point to the end of the current line.
- Option–Left Arrow: Move the insertion point to the beginning of the previous word.
- Option–Right Arrow: Move the insertion point to the end of the next word.
- Shift–Command–Up Arrow: Select the text between the insertion point and the beginning of the document.
- Shift–Command–Down Arrow: Select the text between the insertion point and the end of the document.
- Shift–Command–Left Arrow: Select the text between the insertion point and the beginning of the current line.
- Shift–Command–Right Arrow: Select the text between the insertion point and the end of the current line.
- Shift–Up Arrow: Extend text selection to the nearest character at the same horizontal location on the line above.
- Shift–Down Arrow: Extend text selection to the nearest character at the same horizontal location on the line below.
- Shift–Left Arrow: Extend text selection one character to the left.
- Shift–Right Arrow: Extend text selection one character to the right.
- Option–Shift–Up Arrow: Extend text selection to the beginning of the current paragraph, then to the beginning of the following paragraph if pressed again.
- Option–Shift–Down Arrow: Extend text selection to the end of the current paragraph, then to the end of the following paragraph if pressed again.
- Option–Shift–Left Arrow: Extend text selection to the beginning of the current word, then to the beginning of the following word if pressed again.
- Option–Shift–Right Arrow: Extend text selection to the end of the current word, then to the end of the following word if pressed again.
- Control-A: Move to the beginning of the line or paragraph.
- Control-E: Move to the end of a line or paragraph.
- Control-F: Move one character forward.
- Control-B: Move one character backward.
- Control-L: Center the cursor or selection in the visible area.
- Control-P: Move up one line.
- Control-N: Move down one line.
- Control-O: Insert a new line after the insertion point.
- Control-T: Swap the character behind the insertion point with the character in front of the insertion point.
- Command–Left Curly Bracket ({): Left align.
- Command–Right Curly Bracket (}): Right align.
- Shift–Command–Vertical bar (|): Center align.
- Option-Command-F: Go to the search field.
- Option-Command-T: Show or hide a toolbar in the app.
- Option-Command-C: Copy Style: Copy the formatting settings of the selected item to the Clipboard.
- Option-Command-V: Paste Style: Apply the copied style to the selected item.
- Option-Shift-Command-V: Paste and Match Style: Apply the style of the surrounding content to the item pasted within that content.
- Option-Command-I: Show or hide the inspector window.
- Shift-Command-P: Page setup: Display a window for selecting document settings.
- Shift-Command-S: Display the Save As dialog, or duplicate the current document.
- Shift–Command–Minus sign (-): Decrease the size of the selected item.
- Shift–Command–Plus sign (+): Increase the size of the selected item. Command–Equal sign (=) performs the same function.
- Shift–Command–Question mark (?): Open the Help menu.
Other shortcuts
For more shortcuts, check the shortcut abbreviations shown in the menus of your apps. Every app can have its own shortcuts, and shortcuts that work in one app might not work in another.
- Apple Music shortcuts: Choose Help > Keyboard shortcuts from the menu bar in the Music app.
- Other shortcuts: Choose Apple menu > System Preferences, click Keyboard, then click Shortcuts.
Learn more
- Create your own shortcuts and resolve conflicts between shortcuts
- Change the behavior of the function keys or modifier keys
Category: «Elcomsoft News», «General», «Security», «Software», «Tips & Tricks»
We have just released a brand new tool, and this time it's not about mobile forensics. Or is it?
Elcomsoft Password Digger is designed for decrypting the content of Mac OS protected storage, the keychain. For one, it's a Windows tool, so you'll need to pull keychain files from the Mac OS system along with any decryption metadata (such as the key file for the system keychain or user's password for decrypting the user keychain). After decrypting the keychain, we'll export everything into an XML, and create a filtered plain-text file that only contains passwords (to be used as a pluggable dictionary in various password recovery tools).
So what is this all about?
Mac OS Keychain
It's about passwords. This time around, we are targeting passwords Mac OS users keep in the Keychain. If you follow our blog, you've already head of iOS keychain. In iOS-powered devices such as iPhone and iPad, keychain is used to keep a lot of highly sensitive information. With every major iOS release, Apple seems to move more and more stuff under the umbrella of this encrypted storage.
Dealing with iOS keychains is extremely tough, as those are securely protected by strong, hardware-based encryption keys. When dealing with an iPhone, we can only access decrypted keychain via physical acquisition (jailbreak required, 32-bit devices only) or extract from a password-protected backup. Fortunately, keychain acquisition is much easier for computers running Apple's desktop OS, Mac OS X.
According to various sources, approximately 4.9 to 6.5 of all desktop and laptop computers are running Mac OS X. The use of Mac OS is on the rise, with more Apple computers sold every year compared to other platforms. In Mac OS, the keychain plays the role of a system-wide, centralized password storage. It's preinstalled on every system, it's convenient and extremely simple to use, which makes it the tool of choice for most users. As a result, nearly every password a Mac OS user ever types ends up in the keychain.
What's In There?
As already mentioned, nearly every password the user ever types ends up in the keychain. After just a few days of using the system, the user may've already typed the following passwords:
System Keychain
- Wi-Fi passwords
- User Keychain
- Apple ID password
- Password to iTunes backups
- AirPort and TimeCapsule passwords
- Passwords to Web sites and accounts
- VPN, RDP, FTP and SSH passwords
- Passwords to mail accounts including Gmail and Microsoft Exchange
- Passwords to social networks
- Passwords to network shares
- iWork document passwords
That's a lot of passwords in a single storage! Extracting them can surely help an investigation. However, there is one particular password that can help the most. And that is the user's Apple ID password.
Apple ID Password: The Goldmine
If you manage to decrypt the keychain and discover the user's Apple ID and password, you may have just found a goldmine. With Apple ID and password, you may be able to log in to the user's Apple account to download and analyze over-the-air backups saved by all iOS devices registered to that account. This includes the user's iPhone, iPad and iPod Touch devices. If you're lucky and no two-factor authentication is present, you can simply use Elcomsoft Phone Breaker Forensic to download a clean, unencrypted backup that can be viewed in Elcomsoft Phone Viewer or analyzed in one of the many commercial forensic tools.
* Does not apply to the Touch ID sensor.
Finder and system shortcuts
- Command-D: Duplicate the selected files.
- Command-E: Eject the selected disk or volume.
- Command-F: Start a Spotlight search in the Finder window.
- Command-I: Show the Get Info window for a selected file.
- Command-R: (1) When an alias is selected in the Finder: show the original file for the selected alias. (2) In some apps, such as Calendar or Safari, refresh or reload the page. (3) In Software Update preferences, check for software updates again.
- Shift-Command-C: Open the Computer window.
- Shift-Command-D: Open the desktop folder.
- Shift-Command-F: Open the Recents window, showing all of the files you viewed or changed recently.
- Shift-Command-G: Open a Go to Folder window.
- Shift-Command-H: Open the Home folder of the current macOS user account.
- Shift-Command-I: Open iCloud Drive.
- Shift-Command-K: Open the Network window.
- Option-Command-L: Open the Downloads folder.
- Shift-Command-N: Create a new folder.
- Shift-Command-O: Open the Documents folder.
- Shift-Command-P: Show or hide the Preview pane in Finder windows.
- Shift-Command-R: Open the AirDrop window.
- Shift-Command-T: Show or hide the tab bar in Finder windows.
- Control-Shift-Command-T: Add selected Finder item to the Dock (OS X Mavericks or later)
- Shift-Command-U: Open the Utilities folder.
- Option-Command-D: Show or hide the Dock.
- Control-Command-T: Add the selected item to the sidebar (OS X Mavericks or later).
- Option-Command-P: Hide or show the path bar in Finder windows.
- Option-Command-S: Hide or show the Sidebar in Finder windows.
- Command–Slash (/): Hide or show the status bar in Finder windows.
- Command-J: Show View Options.
- Command-K: Open the Connect to Server window.
- Control-Command-A: Make an alias of the selected item.
- Command-N: Open a new Finder window.
- Option-Command-N: Create a new Smart Folder.
- Command-T: Show or hide the tab bar when a single tab is open in the current Finder window.
- Option-Command-T: Show or hide the toolbar when a single tab is open in the current Finder window.
- Option-Command-V: Move the files in the Clipboard from their original location to the current location.
- Command-Y: Use Quick Look to preview the selected files.
- Option-Command-Y: View a Quick Look slideshow of the selected files.
- Command-1: View the items in the Finder window as icons.
- Command-2: View the items in a Finder window as a list.
- Command-3: View the items in a Finder window in columns.
- Command-4: View the items in a Finder window in a gallery.
- Command–Left Bracket ([): Go to the previous folder.
- Command–Right Bracket (]): Go to the next folder.
- Command–Up Arrow: Open the folder that contains the current folder.
- Command–Control–Up Arrow: Open the folder that contains the current folder in a new window.
- Command–Down Arrow: Open the selected item.
- Right Arrow: Open the selected folder. This works only when in list view.
- Left Arrow: Close the selected folder. This works only when in list view.
- Command-Delete: Move the selected item to the Trash.
- Shift-Command-Delete: Empty the Trash.
- Option-Shift-Command-Delete: Empty the Trash without confirmation dialog.
- Command–Brightness Down: Turn video mirroring on or off when your Mac is connected to more than one display.
- Option–Brightness Up: Open Displays preferences. This works with either Brightness key.
- Control–Brightness Up or Control–Brightness Down: Change the brightness of your external display, if supported by your display.
- Option–Shift–Brightness Up or Option–Shift–Brightness Down: Adjust the display brightness in smaller steps. Add the Control key to this shortcut to make the adjustment on your external display, if supported by your display.
- Option–Mission Control: Open Mission Control preferences.
- Command–Mission Control: Show the desktop.
- Control–Down Arrow: Show all windows of the front app.
- Option–Volume Up: Open Sound preferences. This works with any of the volume keys.
- Option–Shift–Volume Up or Option–Shift–Volume Down: Adjust the sound volume in smaller steps.
- Option–Keyboard Brightness Up: Open Keyboard preferences. This works with either Keyboard Brightness key.
- Option–Shift–Keyboard Brightness Up or Option–Shift–Keyboard Brightness Down: Adjust the keyboard brightness in smaller steps.
- Option key while double-clicking: Open the item in a separate window, then close the original window.
- Command key while double-clicking: Open a folder in a separate tab or window.
- Command key while dragging to another volume: Move the dragged item to the other volume, instead of copying it.
- Option key while dragging: Copy the dragged item. The pointer changes while you drag the item.
- Option-Command while dragging: Make an alias of the dragged item. The pointer changes while you drag the item.
- Option-click a disclosure triangle: Open all folders within the selected folder. This works only when in list view.
- Command-click a window title: See the folders that contain the current folder.
- Learn how to use Command or Shift to select multiple items in the Finder.
- Click the Go menu in the Finder menu bar to see shortcuts for opening many commonly used folders, such as Applications, Documents, Downloads, Utilities, and iCloud Drive.
Document shortcuts
The behavior of these shortcuts may vary with the app you're using.
- Command-B: Boldface the selected text, or turn boldfacing on or off.
- Command-I: Italicize the selected text, or turn italics on or off.
- Command-K: Add a web link.
- Command-U: Underline the selected text, or turn underlining on or off.
- Command-T: Show or hide the Fonts window.
- Command-D: Select the Desktop folder from within an Open dialog or Save dialog.
- Control-Command-D: Show or hide the definition of the selected word.
- Shift-Command-Colon (:): Display the Spelling and Grammar window.
- Command-Semicolon (;): Find misspelled words in the document.
- Option-Delete: Delete the word to the left of the insertion point.
- Control-H: Delete the character to the left of the insertion point. Or use Delete.
- Control-D: Delete the character to the right of the insertion point. Or use Fn-Delete.
- Fn-Delete: Forward delete on keyboards that don't have a Forward Delete key. Or use Control-D.
- Control-K: Delete the text between the insertion point and the end of the line or paragraph.
- Fn–Up Arrow: Page Up: Scroll up one page.
- Fn–Down Arrow: Page Down: Scroll down one page.
- Fn–Left Arrow: Home: Scroll to the beginning of a document.
- Fn–Right Arrow: End: Scroll to the end of a document.
- Command–Up Arrow: Move the insertion point to the beginning of the document.
- Command–Down Arrow: Move the insertion point to the end of the document.
- Command–Left Arrow: Move the insertion point to the beginning of the current line.
- Command–Right Arrow: Move the insertion point to the end of the current line.
- Option–Left Arrow: Move the insertion point to the beginning of the previous word.
- Option–Right Arrow: Move the insertion point to the end of the next word.
- Shift–Command–Up Arrow: Select the text between the insertion point and the beginning of the document.
- Shift–Command–Down Arrow: Select the text between the insertion point and the end of the document.
- Shift–Command–Left Arrow: Select the text between the insertion point and the beginning of the current line.
- Shift–Command–Right Arrow: Select the text between the insertion point and the end of the current line.
- Shift–Up Arrow: Extend text selection to the nearest character at the same horizontal location on the line above.
- Shift–Down Arrow: Extend text selection to the nearest character at the same horizontal location on the line below.
- Shift–Left Arrow: Extend text selection one character to the left.
- Shift–Right Arrow: Extend text selection one character to the right.
- Option–Shift–Up Arrow: Extend text selection to the beginning of the current paragraph, then to the beginning of the following paragraph if pressed again.
- Option–Shift–Down Arrow: Extend text selection to the end of the current paragraph, then to the end of the following paragraph if pressed again.
- Option–Shift–Left Arrow: Extend text selection to the beginning of the current word, then to the beginning of the following word if pressed again.
- Option–Shift–Right Arrow: Extend text selection to the end of the current word, then to the end of the following word if pressed again.
- Control-A: Move to the beginning of the line or paragraph.
- Control-E: Move to the end of a line or paragraph.
- Control-F: Move one character forward.
- Control-B: Move one character backward.
- Control-L: Center the cursor or selection in the visible area.
- Control-P: Move up one line.
- Control-N: Move down one line.
- Control-O: Insert a new line after the insertion point.
- Control-T: Swap the character behind the insertion point with the character in front of the insertion point.
- Command–Left Curly Bracket ({): Left align.
- Command–Right Curly Bracket (}): Right align.
- Shift–Command–Vertical bar (|): Center align.
- Option-Command-F: Go to the search field.
- Option-Command-T: Show or hide a toolbar in the app.
- Option-Command-C: Copy Style: Copy the formatting settings of the selected item to the Clipboard.
- Option-Command-V: Paste Style: Apply the copied style to the selected item.
- Option-Shift-Command-V: Paste and Match Style: Apply the style of the surrounding content to the item pasted within that content.
- Option-Command-I: Show or hide the inspector window.
- Shift-Command-P: Page setup: Display a window for selecting document settings.
- Shift-Command-S: Display the Save As dialog, or duplicate the current document.
- Shift–Command–Minus sign (-): Decrease the size of the selected item.
- Shift–Command–Plus sign (+): Increase the size of the selected item. Command–Equal sign (=) performs the same function.
- Shift–Command–Question mark (?): Open the Help menu.
Other shortcuts
For more shortcuts, check the shortcut abbreviations shown in the menus of your apps. Every app can have its own shortcuts, and shortcuts that work in one app might not work in another.
- Apple Music shortcuts: Choose Help > Keyboard shortcuts from the menu bar in the Music app.
- Other shortcuts: Choose Apple menu > System Preferences, click Keyboard, then click Shortcuts.
Learn more
- Create your own shortcuts and resolve conflicts between shortcuts
- Change the behavior of the function keys or modifier keys
Category: «Elcomsoft News», «General», «Security», «Software», «Tips & Tricks»
We have just released a brand new tool, and this time it's not about mobile forensics. Or is it?
Elcomsoft Password Digger is designed for decrypting the content of Mac OS protected storage, the keychain. For one, it's a Windows tool, so you'll need to pull keychain files from the Mac OS system along with any decryption metadata (such as the key file for the system keychain or user's password for decrypting the user keychain). After decrypting the keychain, we'll export everything into an XML, and create a filtered plain-text file that only contains passwords (to be used as a pluggable dictionary in various password recovery tools).
So what is this all about?
Mac OS Keychain
It's about passwords. This time around, we are targeting passwords Mac OS users keep in the Keychain. If you follow our blog, you've already head of iOS keychain. In iOS-powered devices such as iPhone and iPad, keychain is used to keep a lot of highly sensitive information. With every major iOS release, Apple seems to move more and more stuff under the umbrella of this encrypted storage.
Dealing with iOS keychains is extremely tough, as those are securely protected by strong, hardware-based encryption keys. When dealing with an iPhone, we can only access decrypted keychain via physical acquisition (jailbreak required, 32-bit devices only) or extract from a password-protected backup. Fortunately, keychain acquisition is much easier for computers running Apple's desktop OS, Mac OS X.
According to various sources, approximately 4.9 to 6.5 of all desktop and laptop computers are running Mac OS X. The use of Mac OS is on the rise, with more Apple computers sold every year compared to other platforms. In Mac OS, the keychain plays the role of a system-wide, centralized password storage. It's preinstalled on every system, it's convenient and extremely simple to use, which makes it the tool of choice for most users. As a result, nearly every password a Mac OS user ever types ends up in the keychain.
What's In There?
As already mentioned, nearly every password the user ever types ends up in the keychain. After just a few days of using the system, the user may've already typed the following passwords:
System Keychain
- Wi-Fi passwords
- User Keychain
- Apple ID password
- Password to iTunes backups
- AirPort and TimeCapsule passwords
- Passwords to Web sites and accounts
- VPN, RDP, FTP and SSH passwords
- Passwords to mail accounts including Gmail and Microsoft Exchange
- Passwords to social networks
- Passwords to network shares
- iWork document passwords
That's a lot of passwords in a single storage! Extracting them can surely help an investigation. However, there is one particular password that can help the most. And that is the user's Apple ID password.
Apple ID Password: The Goldmine
If you manage to decrypt the keychain and discover the user's Apple ID and password, you may have just found a goldmine. With Apple ID and password, you may be able to log in to the user's Apple account to download and analyze over-the-air backups saved by all iOS devices registered to that account. This includes the user's iPhone, iPad and iPod Touch devices. If you're lucky and no two-factor authentication is present, you can simply use Elcomsoft Phone Breaker Forensic to download a clean, unencrypted backup that can be viewed in Elcomsoft Phone Viewer or analyzed in one of the many commercial forensic tools.
Building a Custom Dictionary
Another purpose of using Elcomsoft Password Digger is building a custom dictionary containing all of the user's passwords. As you may know, many types of passwords are just too slow to brute force. For example, even if you use a high-end hardware accelerator, you can only try about 25,000 password combinations per second when attacking documents encrypted with Microsoft Office 2013. That's not a lot, and rules out attacks on long, complex passwords – unless you have a good dictionary. And what could be more relevant for breaking a strong password than a dictionary containing that user's other passwords? Elcomsoft Password Digger builds just that: a highly relevant dictionary that contains all passwords stored by the user in the Mac OS keychain.
Even if the dictionary attack doesn't work right away, there are other helpful options available. By just looking at someone's passwords you can get an idea on whether they reused a common password among multiple accounts, or had a specific pattern for memorizing their passwords. This information will help building a custom template or mask when performing a brute-force attack.
Using Apple Keychain Access
If you are using a Mac, you can get an idea of what sort of data is stored in the keychain. Just launch Keychain Access, a built-in tool available in every version of Mac OS, and you'll see the list of passwords along with URLs (or application names), date and time, and other relevant information. When using Keychain Access, you'll have to type your password every time when opening a new record, so using Keychain Access for an investigation is probably not the best idea.
The secret of the sacred seasons mac os. Requirements to Extract Keychain Data
In order to use Elcomsoft Password Digger, you'll need a Windows PC to run the tool, a set of keychain files extracted from the target Mac OS computer, and the user's authentication information (Mac OS login and password or keychain password, if it's different). For decrypting the system keychain, you'll need a decryption key that must be extracted from the Mac OS computer (administrative privileges required).
System Keychain
- Keychain file extracted from the user's Mac OS system
- Decryption key from the same system *
* The decryption key for system keychain must be extracted; administrative privileges are required if extracting from a live system
User Keychain
- Keychain file extracted from the user's Mac OS system
- User's local login password or keychain password (if different)
Obtaining Keychain Files
In order to decrypt the keychain with Elcomsoft Password Digger, the first thing you'll need aside of the ElcomSoft tool is the keychain itself. In Mac OS, keychain is stored in several physical files. Yet another file holds the decryption key for the system keychain. You'll need all of these in order to gain full access to encrypted information.
If you're acquiring keychain files from a live Mac OS X system, do the following.
- Make a new folder on the desktop (e.g. 'KEYCHAINS').
- Open Terminal and issue the following command:cd Desktop/KEYCHAINS
- Copy the following files into the current folder ( 'KEYCHAINS'):
cp /Users//Library/Keychains/login.keychain .
cp /Library/Keychains/System.keychain .
sudo cp /private/var/db/SystemKey .
Note that you need superuser access in order to extract SystemKey, a file that contains encryption metadata for decrypting system keychain. You'll be prompted for apassword.Also note there is a final dot at the end of each 'copy' command. This is not a formatting error; the dot means that the file is to be copied into the current folder ('KEYCHAINS' in our case). is the name of the user who's keychain you are about to extract (currently logged in user is displayed before the '$' sign).
Breaking Point Mac Os Download
- Transfer the content of the 'KEYCHAINS' folder to the Windows PC where you have Elcomsoft Password Digger installed. When Elcomsoft Password Digger prompts you for keychain location, point it to that folder.
If you have a disk image instead of the live system, extracting files is easier since you won't need superuser access or admin password. Just mount the disk image and use your favorite file manager to copy the required files to your Windows computer.
Mounting the disk image is normally not a problem. If you're dealing with a DMG image, Mac OS has built-in tools to mount it. If the disk image is in EnCase .E01 format, you'll need to use third-party tools to mount the image.
Issues and Obstacles
The keychain is supposed to be secure, yet Elcomsoft Password Digger offers instant decryption. So is there something wrong with keychain security, or are we not telling something?
Well, in fact, there are certain obstacles that can make keychain acquisition and/or decryption difficult of impossible. If, for example, the disk is encrypted with FileVault2, we won't be able to extract keychain files, so there will be nothing to decrypt.
Another potential issue is attempting to decrypt a user keychain with a missing password. Since Elcomsoft Password Digger requires a password to decrypt the keychain, there's really nothing the tool can do if the password is not known. At this time, we are working to add the ability to break keychain passwords to Elcomsoft Distributed Password Recovery; we'll post immediately when it's ready.
It's Getting Better
Download New Mac Os
Elcomsoft Password Digger is still new. Version 1.0 can only accept keychain files copied from a Mac OS X system. This very moment we're working on building a native Mac OS version of the tool, and adding two alternative ways to acquire keychains:
See the two greyed-out options? The native Mac OS tool will be able to extract keychain files automatically from the current system (if launched on the computer being investigated; administrative password required for extracting decryption key for the system keychain). Both Windows and Mac OS tools will be able to use an offline disk or mounted disk image to automatically locate and extract system and user keychains. The update will be free to those who purchase the initial edition.