Knowledgebase: E3
Adding iTunes Backup Evidence
Posted by Jack H. Ward, Last modified by Jack H. Ward on 29 January 2018 03:20 AM

iTunes backup is a database created by iTunes that contains backup data from iPhone, iPad, and iPod Touch devices.

iTunes backup data is stored in a folder, containing the following files:

  • plist
  • mdbd
  • plist
  • plist

iTunes backup data default location:

Windows 7/8/10

C:\Users\<login name>\AppData\Roaming\Apple Computer\MobileSync\Backup\{UDID} or %APPDATA%\Apple Computer\MobileSync\Backup\{UDID}

OS X

~/Library/Application Support/MobileSync/Backup/{UDID}


The following iTunes backups are supported:

  • iOS 1.x-10.2 non-encrypted backups
  • iOS 3.x-10.2 encrypted backups. A password is required to parse encrypted backups.

To add new iTunes backup evidence to the case:

1. On the Evidence tab, in the Evidence group, click Add Evidence; or right-click the case node and select Add New Evidence; or click Add Evidence on the Welcome screen. (If you add evidence before creating or opening a new case, the case will be created automatically and saved to the default location. The name of the case file will be e3).

2. The Add New Evidence window opens.
3. In the Category list, select Mobile Data. In the Source Type list, select iTunes Backup. Click OK.



4. Navigate to the Evidence Source (a folder that contains iPhone/iPad/iPod Touch backup files) and select it. Click OK.
5. Enter the Evidence name (by default, the name of the file to be added) and click OK.
6. The iTunes backup evidence is added to the case.
7. The nodes and folders containing data are displayed in the Case Content pane (to the left). Grids with parsed information and files with unparsed binary data are displayed in the Data View pane (to the right).

The investigation of iTunes backup data evidence is possible with the following packages:

  • E3: Universal
  • E3: P2C

You can also import iTunes backup files to a case with E3: DS package via the Import wizard.






Attachments 
 
 Adding iTunes Backup Evidence.png (21.88 KB)
(0 vote(s))
Helpful
Not helpful

Comments (0)