iTunes Backup Explorer
iTunes Backup Explorer is a graphical open-source tool that can show, extract, and replace files in iPhone and iPad backups.
It supports both encrypted and non-encrypted backups, currently from iOS 10.2 onwards.
Most programs that support encrypted backups are either limited trials or expensive. There are apparently only very few open-source projects that target this issue and none that are also useful for the average user.
Installation
- Open your terminal and type in
java -version. - If the command was not found or the version is below 11, download and install Java for your operating system, e.g. from here.
- Download the jar file of the latest release of iTunes Backup Explorer.
Windows
- Simply double-click the downloaded file to start the program.
- From the command line:
java -jar JARFILE.jar. ReplaceJARFILE.jarwith the name of the file you downloaded.
macOS
cdto the download directory and type inchmod +x JARFILE.jar.- You may need to enable Full Disk Access in System Preferences -> Security -> Privacy for the Jar Launcher or Terminal.app / iTerm.app.
- Now, you should be able to simply double-click the file to start the program.
- If that does not work, you may need to type
java -jar JARFILE.jarinto the terminal to run it.
Linux
cdto the download directory and type inchmod +x JARFILE.jar.- Depending on your specific system, you should be able to double-click the file to start the program.
- If that does not work, use
java -jar JARFILE.jarto run it.
File Search
In the "File Search" tab, you can search for files using case-insensitive SQLite LIKE syntax.
It supports two wildcards: % and _.
%matches any sequence of zero or more characters._matches any single character.\is used as the escape character.
Here are a few examples:
| Domain | Relative Path | |
|---|---|---|
| Videos in the camera roll | CameraRollDomain | %.mov |
| Files under the DCIM directory | CameraRollDomain | Media/DCIM/% |
| All .sqlite files | % | %.sqlite |
| .db databases in the home domain | HomeDomain | %.db |
| All WhatsApp files | %whatsapp% | % |
| App documents on iCloud | HomeDomain | Library/Mobile Documents/iCloud~% |
| All files (can take a bit of time) | % | % |
After you clicked on the Search button, you can also sort by clicking on a column name.
To find the largest files, type in a query, click on Search and then twice on Size.
With the Export matching button on the bottom right, you can export all files that match your query to a directory you choose.
By right-clicking on a file row, you can open, extract, replace or delete a single file. This works the same as in the hierarchical "Files" tab. If it is a symbolic link, you can show the target location.
Privacy
For me, this was a matter of course, but it was pointed out that I should clarify it anyway. I do not collect any personal data. In fact, the program does not even use an internet connection at this time. If that should change at some point in the future, I will update this notice.
Credits
I started looking into this after I saw this brilliant answer on StackOverflow by andrewdotn to a question that has already been viewed more than 220.000 times. It explains in detail how iOS backups are structured and how they are encrypted, even providing a working code example.
So a huge thanks to him,
his sources iPhone Data Protection in Depth, iOS Hacker's Handbook, a GitHub comment, the iphone-dataprotection project and the Apple iOS Security Guide for iOS 11 (in the Web Archive)
and Forensic Analysis of iTunes Backups by Jack Farley