Iphone backup - A-DONALD/iBackup-Extractor GitHub Wiki
The files found in the backup directory can be classified into five categories:
- SQLite3 database files;
- Plain text plist files;
- Binary plist files;
- Multimedia and text files.
- Non-standard data files.
In addition to the files described before, the backup directory contains five more standard files with a fixed name:
- Info.plist (plain text plist) stores data about the backed up device (such as the device name, GUID, ICC-ID, IMEI, and serial number) and the iTunes software used to build the backup (such as iTunes settings and the iTunes version number).
- Manifest.plist (binary plist) describes the contents of the backup
- Status.plist (binary plist) seems to store information about the status of the backup itself, such as whether the backup is complete or not
- Manifest.db : file in an iPhone backup is a SQLite database that contains metadata about the various files and directories that are stored in the backup. Headers in Manifest.db database :
| Header | Description |
|---|---|
| fileID | The numbers and letters under fileID are the file names in the backup as in the folders with the manifest.db |
| domain | What sandbox the file is in |
| relativePath | File relative to domain |
| flags | Unix file flags? |
| file | Binary plist containing poperties |
- Manifest.mbdx
The first categorization of backup files is described by their domain. The domain for each file is written in its corresponding record in the Manifest.mbdb file. Each file has a domain name chosen from the following list:
| iOS backup domain | Data found in this domain |
|---|---|
| Application Groups | Data stored here by apps is able to be shared slightly more freely on the device. Many applications will store a small amount of data here, but rarely will you see valuable content. |
| Application Plugins | Apps that store data here usually do so as part of an iOS extension. That may be as a Watch plugin, a third-party keyboard, a widget, a sharing extension, or an Animoji. This domain rarely contains user data. |
| Applications | This is the core domain for apps to store user data on an iPhone. Each app has its own namespace, as described in the “What’s in a namespace?” section above. |
| Camera Roll | The camera roll domain includes all photos, videos and metadata stored on an iOS device. If the device is configured to “Optimise Storage”, and not to store all photos locally, this domain may contain less information than one expects. |
| Databases | Little information is stored here on modern installs of iOS. |
| Health | HealthKit and medical data is stored in the Health domain, along with activity data being shared with a paired Apple Watch. |
| Home | The Home domain is a goldmine of information for many of Apple’s built-in applications, such as Messages, Notes and Calendar. |
| HomeKit | This domain stores a limited amount of information on the state of Apple HomeKit configuration. |
| Install | The Install domain contains metadata to indicate which built-in Apple apps are installed on the iOS device. |
| Keyboard | Language and keyboard configuration is stored in this domain. |
| Keychain | The iOS device’s keychain (a collection of user passwords) is stored here, in a SQLite file. |
| Managed Preferences | This domain contains data around the management of the iOS device. If your device is enrolled in an MDM (mobile device management) program, perhaps by your school or employer, some metadata will be stored here. |
| Media | Many types of media are stored under this domain. For instance, users will find attachments to SMS messages, recordings, and PhotoStream data here. |
| Root | The root domains contains fundamental configuration files for the setup of the iOS device. |
| System Containers | The system containers domain contains limited metadata from the App Store app, and some other iOS processes. |
| System Preferences | This domain contains low-level information on an iOS device’s status. For instance, you can learn about its networking configuration, or about the wi-fi networks or VPNs it has recently connected to. |
| System Shared Containers | Some iOS system processes which can share data across iOS store their data here. It is a good place to start when looking to learn more about Bluetooth activity on a device, for instance. |
| Wireless | The wireless domain contains a rich set of information on iOS’s use of cellular and wi-fi networks, and of its recent IP address assignations. |
For more informations check out : https://reincubate.com/support/how-to/iphone-backup-files-structure/ https://www.richinfante.com/2017/3/16/reverse-engineering-the-ios-backup/#manifestdb