Information Technology Reference
In-Depth Information
4. Select the backup you need and click on
Download
. It prompts you for a destina-
tion directory to save the extracted files into a number of domain directories by
restoring the original filenames. The tool also provides an option to download the
backup without restoring the original filenames so that you can use third-party
software for analysis.
For iCloud backups, the keychain file contents are encrypted with a set of class keys in the
Backup keybag. The Backup keybag itself is protected with a key (
0x835
) derived from
the iPhone hardware key (UID key). You can follow the techniques explained in the pre-
ceding sections to decrypt the keychain from the extracted iCloud backup.
