iOS Backup (iTunes/Finder)
| Format | iOS Backup (iTunes/Finder) |
|---|---|
| Short name | iOS Backup |
| Category | archive |
| Platforms | Windows, macOS, iOS |
| Crush support | Supported (ITunesBackupVFS) |
| Status | Reviewed |
| Last reviewed | 2026-10-04 |
Forensic relevance
Local iOS device backup created by iTunes (Windows/older macOS), Finder (macOS 10.15+) or the Apple Devices app (Windows). Stored at: Windows: %APPDATA%\Apple Computer\MobileSync\Backup\{UDID}\ (Microsoft Store iTunes / Apple Devices: %USERPROFILE%\Apple\MobileSync\Backup\{UDID}\) macOS: ~/Library/Application Support/MobileSync/Backup/{UDID}/ Structure (iOS 10+): 256 subdirectories (00-ff) containing files named by SHA-1 hash of domain+'-'+relativePath — no file extensions, no original filenames; older backups are flat and indexed by Manifest.mbdb. Four key metadata files: Info.plist (device info, installed apps, last backup date, iTunes version), Manifest.plist (backup keybag, encryption flag, WasPasscodeSet, app list), Status.plist (backup state, creation start date), Manifest.db (SQLite index mapping fileIDs to domain/relativePath/metadata). In encrypted backups (IsEncrypted=true) each file is encrypted with a per-file key wrapped by the backup keybag, and since iOS 10.2 Manifest.db itself is encrypted with the ManifestKey stored in Manifest.plist; unencrypted backups leave both the file contents and Manifest.db in the clear. The backup password is not tied to the device passcode. Keychain data (keychain-backup.plist) is present in both, but in unencrypted backups it stays protected with a device UID-derived key and cannot be decrypted off the device. Manifest.plist's WasPasscodeSet shows whether a passcode was set on the device.
Signatures
None recorded
Known extensions
None recorded
References
- Keybags for Data Protection — backup keybag (Apple Platform Security) https://support.apple.com/guide/security/keybags-for-data-protection-sec6483d5760/web
- iTunes Backup format internals, unencrypted / Manifest.mbdb (The Apple Wiki) https://theapplewiki.com/wiki/ITunes_Backup
- iPhone backup forensics 101 (Kinga Kieczkowska / OBTS v7) https://kieczkowska.wordpress.com/2025/04/29/iphone-backup-forensics-101/
- iOS Data Protection on Backup (VulBusters, Medium) https://medium.com/@vulbusters/ios-data-protection-on-backup-6f53d588c830
Cite this entry
Crush Format Reference, “iOS Backup (iTunes/Finder)”. https://kalink0.github.io/crush-forensics/formats/ios-backup/ — source: crush/data/build_formats_db.py at commit 640a2a9928f4e36a976b89901512a8dce824d093, built 2026-10-21 06:46:19 UTC.
Entry in the source at this commit · Change history of the source · Report a correction