Full Guide for Data Extraction from iTunes Backup

Overview

At present, mobile phones can already do most of the work which computers can do, so the memory of mobile phones has increased from the original 2G, 32G, 128G to the current 256G storage capacity. However, when processing the backup of iPhone, iTunes will store the data under the path of the C drive by default to cause the full capacity of C drive is used when large-capacity data is backed up. This article will explain the steps for large-capacity data extraction by modifying the default storage path of data of iPhone.

Analysis Before Data Extraction

To execute the iTunes backup operation, investigators must have a computer either in Mac OS or Windows OS. As long as the computer hard drive is large enough, there is no limit to iTunes backup space. iTunes is Apple’s official free data management software that supports all iOS devices. However, if the version of the operating system of one iOS device is too high to not support to be identified by iTunes, please update the version of iTunes to the newest one to deal with it.

iTunes can back up the device’s almost all data and settings. However, the following data cannot be obtained through iTunes backup:

• The data in iTunes and Apple Store or the PDF which is directly downloaded to the Apple Books.
• The data synced from iTunes, such as imported MP3s,CDs, videos, books and photos.
• The data already stored in iCloud, such as iCloud Photos, iMessages, SMS and MMS
• Face ID or Touch ID settings
• Apple Pay information and settings
• Apple Mail data

Steps for Data Extraction from iTunes Backup

Tools:

1. iTunes
2. Junction (the operating system used this time is windows 10 )
3. SPF Pro (Smartphone Forensics System Professional)

Step 1. Find the local iTunes backup path: C:\Users\Admin\AppData\Roaming \Apple Computer

Step 2. Set the transfer path: Cut the “MobileSync” folder to another local disk with relatively ample storage capacity. Here we store it in the root directory of F drive as an example: F:\ iTunes.

Step 3. Use the “Junction” tool to set the iTunes transfer path.

Download and unzip the Junction tool, and open the command prompt at the folder path where the Junction tool is located: right-click ” Open in Terminal”.

Input the following command: junction.exe ” C:\Users\ Admin \AppData\Roaming\Apple Computer\ MobileSync ” ” F:\ MobileSync “,

If the current account is not an administrator account, please refer to relevant methods on the Internet yourself to authorize the account as an administrator.

Next, take a look at the iTunes backup directory, there will be an additional “MobileSync” folder with an arrow. At this point we can confirm that the “MobileSync” folder has been mapped to the new save path.

Step 4. Use iTunes to back up the iPhone.

Connect the iPhone to the computer and wait for the trust dialog box to pop up on the phone. After trusting, we can see the connected phone in iTunes, as shown in the figure below:

Select the backup function of iTunes

Be careful to check “Encrypt local backup”, then click “Back Up Now” and wait for the backup to complete.

As shown in the picture above, the progress of the backup will be displayed, waiting for the backup to be completed.After the backup is completed, we can view the following content in the new directory.

Please note that after the backup is completed, there will be the following different file names and two at the end of the backup folder. If there are no such files, it means that the backup was not complete and needs to be performed again.

Step 5. Use the SPF Pro (Smartphone Forensic System Professional) to restore the backed up folders.

Firstly, create a new case and input the basic case information.

Select the “Folder Analysis” to add backup folder generated by iTunes for analysis.

Select “Automatic Logical Extraction” to operate the one-click intelligent extraction.

After selecting the basic information and third-party application to be extracted, click “Start” and wait for the data extraction process to be completed.

After data extraction is complete and reviewing the extraction records, a report can be generated in both “HTML” and “PDF” format.

There will be multiple filters about the source of devices, the contents of the checked data, the storage path and format of the report provided for the users.

After the report is exported as the “HTML” format , it can be viewed on the web page.

Notes

• The investigators have to enter the iTunes backup password for data extraction, because the data backed up by iTunes is encrypted.
• Sometimes when we connect the iPhone to the computer via USB cable, we may encounter the problem that the trust dialog box will not pop up on iPhone. We are supposed to refer to the following methods to deal with it.

1. Open iTunes and try to reconnect or reset preferences in iTunes.

2. Update driver

a) Device manager-Portable devices-Apple iPhone

b) Right click “Apple iPhone”-update driver-Search automatically for drivers

c) Select the driver installation directory if the system has checked out the best drivers for your computer C:\Program Files\Common Files\Apple\Mobile Device Support\Drivers

d) If the computer has already installed the best drivers for the device, the following dialog will appear.