iOS Backup Extractor

This repository hosts a small Python 3 command line utility that allows you to restore the original file / folder-structure from an unencrypted iPhone backup.

Background

When creating backups, files are named by the hash of their contents, making it impossible to find a certain file and read it. However, the original file / folder-structure is stored in a SQLite database called Manifest.db within the backup folder. This tool uses the information in the database to restore the original file tree, as it has been on the iPhone. For each domain (e.g. application) a separate folder is created, making it easy to browse the files of certain apps.

Usage

ios-backup-extractor$ python3 iphone-backup-extractor.py -h
usage: ios-backup-extractor.py [-h] [--repack] [--confirm] backup_dir
Restore file/directory structure from decrypted iPhone backups
positional arguments:
 backup_dir Path to the backup directory
optional arguments:
 -h, --help show this help message and exit
 --repack Restore original directory structure
 --confirm Confirm each action

Limitations

One-man project

This is a one-man project which only took a couple of hours to create from scratch. There may be bugs and performance / style issues. Please be careful when running this on a real backup (e.g. create a backup of your backup - backup-ception!)

Encrypted backups

So far, only unencrypted backups are supported. If you have an encrypted backup, you can decrypt it first using the mobile verification toolkit created by Amnesty International for their PEGASUS analysis. That way, you don't have to disable encryption entirely and create a new backup.

Few tests

This has only been tested with one backup of an iPhone SE 1st generation, running iOS 14, created with libimobiledevice (idevicebackup2 v1.3.1). While it should also work with other devices (iPhones, iPads, iPods) and other versions of iOS / iPad OS, this has not been tested yet. If you use this software, please report both working and failed results, so we can triage possible bugs.

Dependencies

Python 3 as well as the following modules are required to run this script:

• sqlite3
• argparse
• os
• plist
• xml

Most of them come preinstalled with standard Python installations. If not, use your system package manager or pip to install them.

Contributing

Contributions are very welcome. Feel free to

• Report successful usage
• Report bugs
• Request features
• Contribute code via pull requests
• Package this utility for your distribution

ToDo

There's room for lots of improvement. A few examples are listed here:

• Clean up code
  • Move code to helper functions
• Add copy mode
• Add simple GUI
• Directly deal with encrypted backups
• Fix confirm mode to actually request confirmation before and not after each action
• Limited extraction of just selected domains
• Add sophisticated logging (verbosity, log files)