Information Technology Reference
In-Depth Information
Unencrypted backup
To create an unencrypted backup, perform the following steps:
1. Connect the iPhone to the forensic workstation using a USB cable.
2. On the forensic workstation, launch iTunes.
3. Click on the iPhone icon displayed in the upper-right corner of the iTunes inter-
face. It displays the iPhone
Summary
page.
4. In the iPhone summary page, select the
This computer
checkbox and click on the
Back Up Now
button.
Extracting unencrypted backups
There are many free tools available to analyze data from unencrypted backups. These tools
parse the
manifest.mbdb
file, restore the filenames, and create the file structure that
users see on the iPhone. Some of the popular tools include iPhone Backup Extractor,
iPhone Backup Browser, and iPhone Data Protection Tools.
iPhone Backup Extractor
iPhone Backup Extractor is a free tool for Mac OS X, which can be downloaded from
ht-
tp://supercrazyawesome.com/
.
The backup extractor expects backup files to be located in
the default location
~/Library/Application Support/MobileSync/
Backup/
. So, you will need to copy any backups you wish to extract to the default loca-
tion. iPhone Backup Extractor is a very easy tool to use.
To extract the backup, follow these steps:
1. Launch the app and click on the
Read Backups
button. It displays a list of backups
available on the forensic workstation. Select the backup that you wish to extract
and click on the
Choose
button, as shown in the following screenshot:
