iTunes_Backup_Reader
Python 3 Script to read iTunes Backups
(Due to a bug in biplist, the script will not work on Python 3.9, please use a lower version of Python or one of the frozen exe's)
Download binary from the Releases section: https://github.com/jfarley248/iTunes_Backup_Analyzer/releases
- Added support for decrypting iOS 10 + Backups
- Code implemented from https://github.com/jsharkey13/iphone_backup_decrypt
Usage:
usage: iTunes_Backup_Reader.py [-h] -i INPUTDIR -o OUTPUTDIR -t OUT_TYPE [-v]
[-b] [--ir] [-r] [-d] [-p PASSWORD]
Utility to Read iTunes Backups
optional arguments:
-h, --help show this help message and exit
-i INPUTDIR, --inputDir INPUTDIR
Path to iTunes Backup Folder
-o OUTPUTDIR, --outputDir OUTPUTDIR
Directory to store results
-t OUT_TYPE, --type OUT_TYPE
Output type. txt csv or db
-v, --verbose increase output verbosity
-b, --bulk Bulk parse. Point at folder containing backup folders
--ir Incident Response Mode. Will automatically check user
folders for backups. Requires admin rights. Point at
root of drive
-r, --recreate Tries to recreate folder structure for unencrypted
backups
-d, --decrypt Just decrypts the backup into an unecrypted, unparsed
format
-p PASSWORD Password for encrypted backups
Backups located in C:\Users{user}\AppData\Roaming\Apple Computer\MobileSync\Backup{GUID}
Artifacts Parsed:
- Recreation of the entire file structure on unencrypted backups
- Device Names
- Device Serial Numbers
- Product Names
- Detection of possibly sideloaded apps
- Product Models
- Phone Numbers
- iOS Version
- Backup Completed
- Backup Completed Write
- If Passcode was Set
- If the Backup is Encrypted
- Device GUID, ICCID, IMEI, & MEID
- iTunes Version
- All applications installed on device (Including sideloaded apps)
- Device Installed on
- Device Serial Number Installed on
- App Name
- AppleID used to Download
- User's Full Name associated with AppleID
- Purchase Date
- App Version
- Auto-Downloaded & Redownloaded
- Publisher
- Full App Name
Updates in Version 3
Version 3.1
- KAPE Support with updated module
- IR Mode which automatically goes through drive and finds iTunes backups
- Bulk processing - Point at a directory of iTunes backups to read them all at once
Version 3.0
- Partial rewrite
- Now FULLY supports parsing unencrypted MBDB backups!
- ex. You can now recreate file structures with older iTunes Backups
- Can now output to CSV, TXT or DB
- More detailed application reports
- More accurate timestamp labeling
- Many bug fixes
- Still no support for decrypting backups :(
- New name to more accurately describe what this tool is doing
Big thanks to Tony Knutson @bigt252002 for helping me test and providing ideas and feedback on new features!
Updates in version 2.1
- Parses binary FRPD files to get the last connected computer names and usernames on the computer
- Sometimes when apps are sideloaded, they don't appear in "Applications", which has most the interesting data, but only in "Installed Applications" which only contains app's full name. Script now makes sure it gets those potentially sideloaded apps
Updates in version 2.0
- Added support for recreating the file structure completely on unencrypted backups
- Added field for each installed application if they were possibly sideloaded
- More verbose logging
- Better exception handling
- Better KAPE implementation by separating backups into folders based on users
Future Updates
- General code refactoring and optimizations
- Need larger datasets to be tested on
Known Issues
- Problems with recreating file structure if NTFS long paths are not enabled