Please Help!!! Encrypted virtualbox cannot be opened with the correct password

[iracer00]

I have my Windows 10 Virtualbox with the encryption method AES-XT256-PLAIN64. encrypted.

I copied and pasted the password from a text file.

Errors are actually impossible.

Now when I try to decrypt my encrypted VM again, I always get the error message incorrect password.

The password cannot be wrong.

I just copied and pasted it.

What could be the error?
What other options do I have to decrypt this?

[scottgus1]

Virtualbox has only the password to start or decrypt an encrypted VM.

Did you encrypt the entire VM, or only the disk file? How did you encrypt, command line or in the VM's Settings? Is this the first time you're trying to encrypt/decrypt? Or has this worked before? And did you take a backup of the unencrypted VM so you can get your data back if the process fails?

Note that there may be a "password identifier" box that has to be set the way you had it before, too. And despite the copy/paste, there may have been errors: accidentally not copying the first or last character and failing to notice (we are human and can make mistakes, especially when we don't notice them so we feel we didn't make one). Try removing a character from the beginning or end.

FWIW I don't think that Virtualbox has a password failure counter, so you can keep trying ideas until you get it, without locking out the VM.

[iracer00]

I only have VDI encrypted via the settings.

I also encrypted another VM in the virtualBox with this password. I decrypt them every day with the same password.
I encrypted the VM and immediately after that I no longer had access. I always just get the wrong password message.

Unfortunately I don't have a backup for it.

I am sure that I copied the password correctly because I copy it several times a day and also saw that it is marked.

Is there a way to crack the password using a hacker tool?
There are over €3500 Bitcoins on it.

[scottgus1]

If you're a state actor (a country with an NSA or CIA or FSB that you can rely on) then you might - might - have a chance.

The intent of such encryption systems is that it would take more computer cycles than there are atoms in the universe to crack.

I don't know of any hacking tools to get around not knowing the password.

If you were copy/pasting, then the vast majority of the password characters would be correct. Only the ends may be suspect. (unless you had accidentally tapped a couple characters on the keyboard before pasting, or pasted twice, or some such.

There is an ID that goes with the password. When I encrypted a test DOS VM just now, the ID was the same name as the VM. I remember that when encrypting via command line an ID has to be provided. If you encrypted the disk through the main Virtualbox window's VM settings, then your VM should show the VM name as the ID for the password needed. If you encrypted via command line, I think you also have to provide whatever password ID you picked in the command line.
For a particular disk encryption, the .vbox file's XML will show something like this:

Code: Select all

<HardDisk uuid="{39fd07c2-fe2d-4093-bf9e-f77b895b18d6}" location="DOS2 encrypted-disk1.vdi" format="VDI" type="Normal">
  <Property name="CRYPT/KeyId" value="DOS2 encrypted"/>
  <Property name="CRYPT/KeyStore" value="U0NORQABQ ... huge pile of characters ... t2oWKjfBIA=="/>
</HardDisk>

The ID for the disk's password is the "value" in the "KeyID" line.

[iracer00]

Yes, the name of my VMb is under Keyid
I don't fully understand this.

Can I therefore remove the encryption?

Code: Select all

<?xml version="1.0"?>
<!--
 DO NOT EDIT THIS FILE.
 If you make changes to this file while any VirtualBox related application
 is running, your changes will be overwritten later, without taking effect.
 Use VBoxManage or the VirtualBox Manager GUI to make changes.
-->
<VirtualBox xmlns="http://www.virtualbox.org/" version="1.19-windows">
  <Machine uuid="{2c4d7f32-7202-4833-bce6-e8ff2cc574cd}" name="Bitcoins" OSType="Windows10_64" snapshotFolder="Snapshots" lastStateChange="2023-12-21T14:47:00Z">
    <MediaRegistry>
      <HardDisks>
        <HardDisk uuid="{60e91ba8-3b35-4c19-a6d3-e3877ccf0860}" location="Bitcoins.vdi" format="VDI" type="Normal">
          <Property name="CRYPT/KeyId" value="Bitcoins"/>
          <Property name="CRYPT/KeyStore" value="U0NORQABQUVTLVhUUzI1Ni1QTEFJTjY0AAAAAAAAAAAAAAAAAABQQktERjItU0hB&#13;&#10;MjU2AAAAAAAAAAAAAAAAAAAAAAAAAEAAAAAjpeBCk2bARtBCmg+KCe8U7630+xuE&#13;&#10;G6lko0hhHFml7SAAAAAnx/6CWe9DrMGao2aDKdwRwp24FVZ68Igfk3tVBGE3syBO&#13;&#10;AAB84wAIobts9rKRW8Rn98IpaQtW8tD5yn3RMr77FJ/4q2DMBQBAAAAAX6Kbm8KV&#13;&#10;QMjW2Z477z5t+2HkqBfVOQw1a0lf6FylWsIV2lct2B8abLorsGdwVv6lCjV5kx5J&#13;&#10;TkCXQCwB/cTKCQ=="/>
        </HardDisk>
      </HardDisks>
      <DVDImages>
        <Image uuid="{0aaf81a9-e587-4490-8dfa-921b5b998660}" location="C:/Users/ANGER-FIRST/Desktop/Windows.iso"/>
      </DVDImages>
    </MediaRegistry>
    <ExtraData>
      <ExtraDataItem name="GUI/LastCloseAction" value="PowerOff"/>
      <ExtraDataItem name="GUI/LastGuestSizeHint" value="1920,977"/>
      <ExtraDataItem name="GUI/LastNormalWindowPosition" value="938,152,720,440"/>
    </ExtraData>
    <Hardware>
      <CPU count="2">
        <PAE enabled="false"/>
        <LongMode enabled="true"/>
        <HardwareVirtExLargePages enabled="true"/>
      </CPU>
      <Memory RAMSize="2048"/>
      <HID Pointing="USBTablet"/>
      <Display controller="VBoxSVGA" VRAMSize="128"/>
      <BIOS>
        <IOAPIC enabled="true"/>
        <SmbiosUuidLittleEndian enabled="true"/>
      </BIOS>
      <USB>
        <Controllers>
          <Controller name="XHCI" type="XHCI"/>
        </Controllers>
      </USB>
      <Network>
        <Adapter slot="0" enabled="true" MACAddress="080027646E3C" cable="false" type="82540EM">
          <NAT localhost-reachable="true"/>
        </Adapter>
      </Network>
      <AudioAdapter controller="HDA" useDefault="true" driver="WAS" enabled="true" enabledOut="true"/>
      <Clipboard mode="Bidirectional"/>
      <GuestProperties>
        <GuestProperty name="/VirtualBox/GuestAdd/Components/VBoxControl.exe" value="7.0.12r159484" timestamp="1702880908784216400" flags=""/>
        <GuestProperty name="/VirtualBox/GuestAdd/Components/VBoxGuest.sys" value="7.0.12r159484" timestamp="1702880908787785500" flags=""/>
        <GuestProperty name="/VirtualBox/GuestAdd/Components/VBoxHook.dll" value="7.0.12r159484" timestamp="1702880908785237000" flags=""/>
        <GuestProperty name="/VirtualBox/GuestAdd/Components/VBoxMRXNP.dll" value="7.0.12r159484" timestamp="1702880908786764400" flags=""/>
        <GuestProperty name="/VirtualBox/GuestAdd/Components/VBoxMouse.sys" value="7.0.12r159484" timestamp="1702880908788296000" flags=""/>
        <GuestProperty name="/VirtualBox/GuestAdd/Components/VBoxSF.sys" value="7.0.12r159484" timestamp="1702880908788804100" flags=""/>
        <GuestProperty name="/VirtualBox/GuestAdd/Components/VBoxService.exe" value="7.0.12r159484" timestamp="1702880908786256501" flags=""/>
        <GuestProperty name="/VirtualBox/GuestAdd/Components/VBoxTray.exe" value="7.0.12r159484" timestamp="1702880908786256500" flags=""/>
        <GuestProperty name="/VirtualBox/GuestAdd/HostVerLastChecked" value="7.0.12" timestamp="1702880935632552300" flags=""/>
        <GuestProperty name="/VirtualBox/GuestAdd/InstallDir" value="C:/Program Files/Oracle/VirtualBox Guest Additions" timestamp="1702880908783198100" flags=""/>
        <GuestProperty name="/VirtualBox/GuestAdd/Revision" value="159484" timestamp="1702880908783191300" flags=""/>
<GuestProperty name="/VirtualBox/GuestAdd/Version" value="7.0.12" timestamp="1702880908782688704" flags=""/>
        <GuestProperty name="/VirtualBox/GuestAdd/VersionExt" value="7.0.12" timestamp="1702880908782688705" flags=""/>
        <GuestProperty name="/VirtualBox/GuestInfo/Net/0/Status" value="Down" timestamp="1702882097697443700" flags=""/>
        <GuestProperty name="/VirtualBox/GuestInfo/Net/0/V4/Broadcast" value="255.255.255.255" timestamp="1702880939587460900" flags=""/>
        <GuestProperty name="/VirtualBox/GuestInfo/Net/0/V4/IP" value="10.0.2.15" timestamp="1702882097696930100" flags=""/>
        <GuestProperty name="/VirtualBox/GuestInfo/Net/0/V4/Netmask" value="255.255.255.0" timestamp="1702882097696930101" flags=""/>
        <GuestProperty name="/VirtualBox/GuestInfo/Net/1/MAC" value="080027646E3C" timestamp="1702880949603876101" flags=""/>
        <GuestProperty name="/VirtualBox/GuestInfo/Net/1/Status" value="Up" timestamp="1702880949603876100" flags=""/>
        <GuestProperty name="/VirtualBox/GuestInfo/Net/1/V4/Broadcast" value="255.255.255.255" timestamp="1702880949603368304" flags=""/>
        <GuestProperty name="/VirtualBox/GuestInfo/Net/1/V4/IP" value="10.0.2.15" timestamp="1702880949603368303" flags=""/>
        <GuestProperty name="/VirtualBox/GuestInfo/Net/1/V4/Netmask" value="255.255.255.0" timestamp="1702880949603368305" flags=""/>
        <GuestProperty name="/VirtualBox/GuestInfo/Net/Count" value="1" timestamp="1702882111626879500" flags=""/>
        <GuestProperty name="/VirtualBox/GuestInfo/OS/Product" value="Windows 10" timestamp="1702880908782688700" flags=""/>
        <GuestProperty name="/VirtualBox/GuestInfo/OS/Release" value="10.0.19045" timestamp="1702880908782688701" flags=""/>
        <GuestProperty name="/VirtualBox/GuestInfo/OS/ServicePack" value="" timestamp="1702880908782688703" flags=""/>
        <GuestProperty name="/VirtualBox/GuestInfo/OS/Version" value="" timestamp="1702880908782688702" flags=""/>
        <GuestProperty name="/VirtualBox/HostInfo/DekMissing" value="1" timestamp="1703168755804584100" flags="RDONLYGUEST"/>
        <GuestProperty name="/VirtualBox/HostInfo/GUI/LanguageID" value="de_DE" timestamp="1703168756131587500" flags="RDONLYGUEST"/>
      </GuestProperties>
      <StorageControllers>
        <StorageController name="SATA" type="AHCI" PortCount="2" useHostIOCache="false" Bootable="true" IDE0MasterEmulationPort="0" IDE0SlaveEmulationPort="1" IDE1MasterEmulationPort="2" IDE1SlaveEmulationPort="3">
          <AttachedDevice type="HardDisk" hotpluggable="false" port="0" device="0">
            <Image uuid="{60e91ba8-3b35-4c19-a6d3-e3877ccf0860}"/>
          </AttachedDevice>
          <AttachedDevice passthrough="false" type="DVD" hotpluggable="false" port="1" device="0">
            <Image uuid="{5f287768-65dc-41bc-be06-219710ad6390}"/>
          </AttachedDevice>
        </StorageController>
      </StorageControllers>
    </Hardware>
  </Machine>
</VirtualBox>

[scottgus1]

No, regrettably. Encryption is designed precisely to prevent what you're trying to do: decrypt the VM without a valid password.

Note that this is not a "Virtualbox problem". It is an "Encryption problem" which is really an "Encryption design feature". You're trying the exact same thing the thief who steals your PC would try. And encryption, either of the VM or the physical PC, is intended to prevent exactly that.

I'm sorry to have to tell you this, but if you cannot experiment enough and determine the password you encrypted the VM with, your VM is not recoverable.

[scottgus1]

Your German-forum topic on this subject has been deleted. Duplicate topics are a forum no-no.

[iracer00]

I found files called: "v.box.-prev" through a data recovery program.

These were either created or deleted by the system before the Bitcoin wallet was created or just a short time later.

Can you use this file to remove VirtualBox's system encryption?

[iracer00]

Can I possibly undo the encryption with this file? Please help

[scottgus1]

No. The encryption is "physically" written into the disk file. If you open the disk file in a hex editor, the entire data area will be filled with unrecognizable hex mish-mash. The password you're missing is used against the key written in the "CRYPT/KeyStore" to come up with the decryption code that is used to turn the mish-mash back into usable data.

Without the decryption code, the mish-mash cannot be decoded.

Without the password, the decryption code cannot be determined.

You cannot get the disk decrypted without the password.

[mingle]

I have my Windows 10 Virtualbox with the encryption method AES-XT256-PLAIN64. encrypted.

...

I copied and pasted the password from a text file.

...

What could be the error?
What other options do I have to decrypt this?

A long-shot, but this could be a simple issue, as I ran into something similar...

What OS are you using? (hopefully it's Windows 11)

I've noticed after I upgraded from Windows 10 to 11 that if I used cut/paste from Notepad, end-of-line characters are also pasted - something which wasn't the case in Windows 10. I haven't nailed down whether it's end-of-line/end-of-paragraph or carriage-returns, but there is a difference between the way it works between Window 10 & 11.

In my case, I was copying/pasting passwords from an often-used list. In Windows 10, there were no problems. However, after an upgrade to Windows 11, using Notepad in exactly the same way, I was getting errors. Manually typing in the password worked fine, but the cut/paste from Notepad gave me an error each time. It only took a short while to realise the extra 'invisible' characters were being pasted and causing certain (though not all) logins to fail. I only assume that certain password-parsing routines ignore certain control codes...

Anyway, I know it's a long-shot, but perhaps consider this?

Cheers,

Mike.