Data Acquisition from iOS Backups - Practical Mobile Forensics - page 119

contain *.mdbackup , *.mdata , *.mdinfo , and some files with no file extensions.
The standard files store details about the backup and the device from which it was de-
rived. These file names are as follows:
• info.plist
• manifest.plist
• status.plist
• manifest.mbdb
The first three files are property list files that can be easily analyzed using the Property
List Editor application on Mac OS X.
info.plist
The info.plist file stores details about the backed up device and typically contains
the following information:
• Device name and display name : This is the name of the device, which typically
includes the owner's name
• ICCID : This is the Integrated Circuit Card Identifier, which is the serial number
of the SIM
• Last backup date : This is the timestamp of the last successful backup
• IMEI : This is the International Mobile Equipment Identity, which is used to
uniquely identify the mobile phone
• Phone Number : This is the phone number of the device at the time of backup
• Installed applications : This is the list of application identifiers on the device
• Product type and production version : This is the device model and firmware
version
• Serial number : This is the serial number of the device
• iTunes version : This is the version of iTunes that generated the backup
• Target Identifier and Unique Identifier : This is the UDID of the device
manifest.plist
The manifest.plist file describes the contents of the backup and typically contains
the following information:
• Applications : This is a list of third-party applications installed on the backed up
device, their version numbers, and bundle identifiers
• Date : This is the timestamp of a backup created or last updated