O'Reilly logo

Learning iOS Forensics - Second Edition by Pasquale Stirparo, Mattia Epifani

Stay ahead with the world's most comprehensive technology and business learning platform.

With Safari, you learn the way you learn best. Get unlimited access to videos, live online training, learning paths, books, tutorials, and more.

Start Free Trial

No credit card required

iTunes backup structure

In a backup folder, there are some standard files with fixed names and contents and hundreds of files with long hashed filenames consisting of 40 hexadecimal characters. The file name acts like a unique identifier for every file copied from the iDevice. In fact, each file is named as the result of an SHA-1 hash calculated on the original full name of the file in the following form:

Domain-[subdomain-]fullpath/filename.ext

Consider the following example:

AppDomain-com.skype.skype-Library/Preferences/com.skype.skype.plist

Here, AppDomain is the name of domain, Com.skype.skype is the subdomain, and Library/Preferences/com.skype.skype.plist is the path and the name of file.

Calculating the SHA-1 hash for AppDomain-com.skype.skype-Library/Preferences/com.skype.skype.plist ...

With Safari, you learn the way you learn best. Get unlimited access to videos, live online training, learning paths, books, interactive tutorials, and more.

Start Free Trial

No credit card required