String value can be a string or aa binary contentĪll values are big endian, strings are composed of a uint16 that contains the length or 0xffff for NULL, then the characters in UTF-8 with canonical decomposition (Unicode normalization form D). Uint8 Propert圜ount number of properties following Uint64 length file size (always 0 for link or directory) Uint32 ctime time of last change of status Mask out ~ 0xf000 (aka S_IFMT) for file permissions See /usr/include/stat.h and stat(2)įile mode: 0xAxxx symbolic link (aka S_IFLNK or 00120000)Ġx4xxx directory (aka S_IFDIR or 0040000)Ġx8xxx regular file (aka S_IFREG or 0100000) String encryptionKey Encryption key for encrypted backups String DataHash SHA-1 of file contents, actual file objects only Record (variable size) string Domain Backup domain (one of Probably a database of file names in the backup.
![itunes backup itunes backup](https://www.leonvirtual.net/noticias/wp-content/uploads/2012/09/Backup1.jpg)
ApplicationIDs (array of string): list of applications (like.It contains names of computers found on the network, like iPodPrefs below. there are folder names (in unicode, starting with the name length).Ī 0x200 byte long file, starting with the text "Pictures" (in unicode) and the name length before it. Then only very few bytes and the content is mostly zero. This is actually a binary plist with the following content (dict): (example):įrpd binary file. ServerSyncUniqueId (string): Pdfs_Collenction_ID.serverSyncUniqueId (string): Reading Location.locationBPlist (data): (base-64 encoded blob, see below).This blob is actually another plist (dict): LibraryApplications (array of string): The array of string contains the identification string of each application, for example.ist (data): (base-64 encoded blob, see below).iTunesPrefs (data): (base-64 encoded blob, see below).PhotosFolderPrefs (data): (base-64 encoded blob, see below).PhotosFolderName (data): (base-64 encoded blob, see below).PhotosFolderAlbums (data): (base-64 encoded blob, see below).IC-Info.siv (data): (base-64 encoded blob, see below).iBooks Data 2 (data): (base-64 encoded blob, see below).
Itunes backup code#
Unique Identifier (string): same 20-byte hex code.Target Identifier (string): 20-byte hex code.iTunes User ID (string): (8-byte hex code).New Record Calendar Name (string): Home.Data Class Info: (array of dict, 5 elements).AMSCollectionDisplayName (string): Calendar.Calendars Collections: (array of dict, 1 element):.Last Backup Date (date): format "yyyy-mm-ddThh:mm:ssZ".GUID (string): unknown 16-byte GUID without any dashes.Display Name (string): (name of the device that was backed up).Device Name (string): (name of the device that was backed up).Build Version (string): 9A406 (iOS build version of the device that was backed up).This is a plaintext plist that contains the following dict:
Itunes backup windows#
![itunes backup itunes backup](https://true-tech.net/wp-content/uploads/2017/07/e2ee3522gy1fi0vp6rlamj20qo0zkjvv.jpg)
The data itself is encrypted with AES-256 CBC. It is not clear what would happen in case of hash collisions. Between the domain and the path there is a dash. The file names are made by a SHA-1 hash of their name, together with their path and domain. There are also the files themselves, but with a new file name. In each backup, there are four files with infos, which are described later:
Itunes backup iso#
A differential backup has the same folder name, but appened with a dash and the ISO date of the backup (8 digit yyyymmdd) and a dash and the time in 24-hour format with seconds.
Itunes backup full#
Every backup folder name corresponds to the UDID of the device for a full backup. In the backup location (see below) there are all backups that iTunes has made so far. There is a differentiation between "domains" and relative files. On the iDevice the file /System/Library/Backup/ist determines what files to backup. The description is for non-encrypted backups only. This description is for the format used in iTunes 10.5.3 an newer - older versions are slightly different (see Understanding iPhone Backup Files). The following description is to describe the backup system of iTunes, which is often used for forensic analysis of iDevices.