Information Technology Reference
In-Depth Information
MobileSync/Backup_extract/HomeDomain/Library/Preferences/
com.apple.voiceservices.plist
Writing /Users/satishb3/Library/Application Support/
MobileSync/Backup_extract/CameraRollDomain/Media/DCIM/
100APPLE/IMG_0038.JPG
Writing /Users/satishb3/Library/Application Support/
MobileSync/Backup_extract/SystemPreferencesDomain/
SystemConfiguration/preferences.plist
Writing /Users/satishb3/Library/Application Support/
MobileSync/Backup_extract/HomeDomain/Library/Preferences/
com.apple.mobileipod.plist
[...]
Writing /Users/satishb3/Library/Application Support/
MobileSync/Backup/
6c1b7aca59e2eba6f4635cfe7c4b2de1bd812898_extract/HomeDomain/
Library/Preferences/com.apple.springboard.plist
You can decrypt the keychain using the following command:
python keychain_tool.py -d "/Users/satishb3/Library/
Application Support/MobileSync/Backup/
6c1b7aca59e2eba6f4635cfe7c4b2de1bd812898_extract/
KeychainDomain/keychain-backup.plist" "/Users/satishb3/
Library/Application Support/MobileSync/Backup/
6c1b7aca59e2eba6f4635cfe7c4b2de1bd812898_extract/
Manifest.plist"
The preceding script creates the 6c1b7aca59e2eba6f4635cfe7c4b2de1b-
d812898_extract folder in the backup directory location and extracts the backup files
into it by restoring the original filenames. The extracted backup files are stored in a num-
ber of domain directories as shown in the following screenshot. Now, you should be able
to completely examine the artifacts on the backup files, which will be covered in detail in
Chapter 5 , iOS Data Analysis and Recovery . Pay attention to the directory names used in
the command line as they vary for each device.
Search WWH ::




Custom Search