Electronic Evidence Examiner allows you to export iTunes backup data from the case. Exporting means making an exact copy of data on the computer where Electronic Evidence Examiner is installed.
To export iTunes backup data, do the following:
1. Add the iTunes backup evidence to a new or existing case.
2. The iTunes backup structure is displayed in the Case Content pane (to the left), the files are displayed in the Data View pane (to the right).
3. In the Data View pane, select the file (or several files) that you want to export. Use the Ctrl and Shift keys to select more than one file.
4. On the Export tab, in the Common Export group, click Export, or right-click the file (files) and select Export.
5. In the Exporting Options window, set the options you need:
- Export to folder: Click this option if you want to export file(s) to a folder on the computer.
- Export to forensic container: Click this option if you want to export file(s) to an encrypted forensic container.
- Destination Path: Define the location of the exported data. Click Browse to navigate to the desired location.
- Password: Enter the password that was set during the forensic container creation (required if Export to forensic container is selected).
6. Click Export. The export process is displayed in the Tasks pane.
7. To view the results:
- If data was exported to a folder, navigate to the selected folder to view the exported file(s).
- If data was exported to a forensic container, add the desired forensic container as evidence and view the results.