iTunes backup folder (Import)

iTunes backups can be imported and the backup is in the form of a folder, typically named with a 40-character hexadecimal code and containing a set of similarly named binary files.

iTunes backups can be encrypted or unencrypted, depending on whether or not a password was set either by the user as a default or, by MOBILedit Forensic during a previous extraction.

An encrypted iTunes backup contains more data than an unencrypted backup as it is more secure and therefore, more suitable for storing personal and private data.

This import option is available for all the license types of MOBILedit Forensic, from single phone licenses through to ULTRA.

iTunes backups may be located in the report output folder from a previous extraction or be stored in the default iTunes backup storage location, for example:

"C:\Users\user1\AppData\Roaming\Apple Computer\MobileSync\Backup\4d14abaa2da8383ae719a6b37226fc9afb1849aa"

MOBILedit Forensic

Select “Import data” and then choose “iTunes backup folder”:

Navigate to the back you wish to import and click “Select folder”

You will be prompted to enter a password using the “Password toolbox” if one was previously set.

If a password was not previously set, it is automatically set by MOBILedit Forensic to “123”. The temporary password is removed once the extraction is complete.

Once the iTunes backup has been successfully loaded you can proceed with a Logical extraction and analysis.