An open community 
of Macintosh users,
for Macintosh users.

FineTunedMac Dashboard widget now available! Download Here

Topic Options
#47720 - 01/28/18 03:38 AM Location of iPhone encrypted backups, where?
Pendragon Offline


Registered: 08/04/09
Loc: Georgetown, Texas, USA
I regularly make encrypted backups (via iTunes) of my iPhone and would like to know where theses files are located.

In part, I ask because I wonder if each backup is archived or just the most recent one. confused
_________________________
Harv
27" i7 iMac (10.13.6), iPhone Xs Max (12.1)

Those who can make you believe absurdities can make you commit atrocities. ~Voltaire

Top
#47734 - 01/30/18 03:38 AM Re: Location of iPhone encrypted backups, where? [Re: Pendragon]
Pendragon Offline


Registered: 08/04/09
Loc: Georgetown, Texas, USA
Yesterday, I was chatting with a colleague from the local MUG and he had the answer to my query. To find/access that file: ~/Library/Application Support/MobileSync/Backup.

So I then tested the process to see if new backups replace the former file or adds to the old file/folder. Answer: the new file replaces the old file.
_________________________
Harv
27" i7 iMac (10.13.6), iPhone Xs Max (12.1)

Those who can make you believe absurdities can make you commit atrocities. ~Voltaire

Top
#47748 - 01/31/18 09:23 AM Re: Location of iPhone encrypted backups, where? [Re: Pendragon]
MacManiac Offline
Moderator

Registered: 08/04/09
Loc: Paradise....on the central Ore...
Thanks Harv....it's always good to share valid resources. Your local MUG sounds like they've got some good stuff going.
_________________________
Freedom is never free....thank a Service member today.

Top
#48054 - 02/26/18 01:19 PM Re: Location of iPhone encrypted backups, where? [Re: Pendragon]
Virtual1 Offline


Registered: 08/04/09
Loc: Iowa
Almost totally off-topic, but I did find out that you can burrow nicely into (at least the unencrypted) iDevice backups and get data out. This is useful if you want to exfiltrate data from some apps, such as grab their configuration plist or even snag text files or even pictures the apps have taken with the cam and stored internally in their data folders. This is possible because iTunes uses sqlite3 to catalog both the backups and the files in the backups.

this bit of code loads the most recently created backup and locates the plist file for the Alertus app, converting it to readable text and saving it for viewing:


Code:
#!/bin/bash

domain='AppDomain-com.alertus.mobile-receiver'
relativePath='Library/Preferences/com.alertus.mobile-receiver.plist'

tempfile="$HOME/.ios_prefs_finder.plist"
rm "$tempfile" 2> /dev/null

root="$HOME/Library/Application Support/MobileSync/Backup"
if [ -z "$1" ] ; then
  backup_folder=$(ls -t "$root" | head -n1)
  #backup_folder="3477366718b569cab02e8e2faaaa626d888ae743"
else
  backup_folder=$1
fi
if [ -z "$backup_folder" ] ; then
  echo "run a backup or supply folder name"
  exit 1
fi
root="$root/$backup_folder"

ts=$(stat -f "%m" "$root")
modified=$(date -j -f "%s" $ts "+%Y/%m/%d %H:%M:%S")

f="$root/Manifest.db"
f=$(sqlite3 "$f" "SELECT fileID FROM Files WHERE (domain='$domain' and relativePath='$relativePath')")

f="$root/${f:0:2}/$f"
echo "plist is backed up at \"$f\""
echo

cp "$f" "$tempfile"
plutil -convert xml1 "$tempfile"

echo "converted to \"$tempfile\""
echo
cat "$tempfile"
echo
exit 0





or if you already have the name of the backup and need to browse it... you can dump that entire list of files into x.txt for reading in your word processor of choice

Code:
root="/Users/virtual1/Library/Application Support/MobileSync/Backup/3477366718b569cab02e8e2faaaa626d888ae743/Manifest.db"
sqlite3 -header -column -cmd '.width 44 110 181 5 48' "$root" "SELECT * FROM Files" > x.txt


Note this is just letting you identify specific files in the backup, from there you just have to copy them out and maybe rename them and have at it. The biggest challenge normally is FINDING the file you are interested in among the effectively random names. But I thought it was also interesting to see what sort of files (and DATA) the apps are keeping on me. I suspect this would be quite interesting to anyone that's bored and thinks maybe some of their apps are spyyyyying on them wink
_________________________
I work for the Department of Redundancy Department

Top

Moderator:  cyn, dianne