The folder also contains the files themselves, but their names are created by a SHA-1 hash of their name, along with their path and domain:įigure 2. ist – stores info about the process of backing up – was it successful or not.ist – stores info about the content of the backup, for example, the list of applications installed on the device.Manifest.mdbd – stores info about backed up files: domain, path, file size, MAC times, etc.ist – stores data about the backed-up device, including its phone number, ICCID, IMEI, etc.
Windows 10 iTunes backup folderįour standard files can be found inside the folders: In these folders, a mobile forensics examiner will find a subfolder with name which is equivalent to the device’s Unique Device Identifier (UDID) – a 40 character long string:įigure 1. Windows Vista, Windows 7, Windows 8 and Windows 10: \Users\\AppData\Roaming\Apple Computer\MobileSync\Backup\.Windows XP: \Documents and Settings\\Application Data\Apple Computer\MobileSync\Backup\.Mac: ~/Library/Application Support/MobileSync/Backup/.If a backup is made by iTunes, it can be found in the following folders: As you know, such backups can be encrypted or unencrypted, and can be found on suspect’s computer drive or be the result of a logical data extraction via your favorite mobile forensics suite or iTunes. Nowadays, an iTunes backup is a common information storage a mobile forensics examiner deals with during iOS device investigations.