iTunes Backups

Overview

Evidence: iTunes Backups Description: Collect iTunes Backups Category: Applications Platform: windows Short Name: itnb Is Parsed: No Sent to Investigation Hub: No Collect File(s): Yes

Background

iTunes/Apple Devices stores iOS device backups in the MobileSync Backup directory. These backups contain app data, messages, photos, contacts, and device configurations from iPhones and iPads synchronized with the computer.

Data Collected

This collector gathers structured data about itunes backups.

Collection Method

This collector gathers iTunes backup directories from Apple application data, collecting complete or partial iOS device backups.

Forensic Value

iTunes backups contain extensive mobile device data including messages, call logs, app data, photos, contacts, and location history. This is invaluable for mobile forensics when the physical device is unavailable, revealing communications, activities, and evidence from iOS devices.