35
316 | Page
Ch a p t e r 2 8 – W o r k i n g w i t h …
Copyright GetData Forensics Pty Ltd 2010 - 2015, All rights reserved.
28.1
ITUNES BACKUPS
When an Apple device (iPhone, iPad, iPod) is connected to a computer for the first
time and synced with iTunes, a folder is created using the unique device ID (UUID).
These ITunes Backup folders are very distinctive, in that they are 40 hexadecimal
characters long. The default folder locations are:
Figure 241, ITunes Backup paths
Windows 7
C:\Users\[username]\AppData\Roaming\Apple
Computer\MobileSync\Backup\
Windows XP C:\Documents and Settings\username\Application
Files\MobileSync\Backup\deviceid
MAC OS X
[User HomeDirectory]/Library/Application
Support/MobileSync/Backup
ITunes Backup UUID folders can contain high value information for the forensic
investigator, particularly if the original device itself cannot be located. Each time an
Apple device is synced with a computer, the UUID backup folder will store
configuration information, address book data, SMS database, call records, the
camera photo cache, and other types of personal data.
Apple device analysis is well documented. Suggested reference material includes:
iOS Forensic Analysis for iPhone, iPad and iPod Touch, Sean Morrissey,
2010, Apress;
iPhone Forensics, 1st Edition, Jonathan Zdziarski, 2008, O͛Reilly Media Inc.
This section is provided only as a guide to process ITunes Backup files with Forensic
Explorer and is not a complete IOS analysis resource.
28.1.1
LOCATING APPLE UUID BACKUP FOLDERS
ITunes Backup UUID folders can be located in the Forensic Explorer File System
module by using the ͞Apple Backups͟ folders filter, as shown in Figure 242 below: