search

hackappcom / iloot

OpenSource tool for iCloud backup extraction
https://hackapp.com/
637 stars 201 forks source link

Manifest.plist #30

Closed jetXS closed 9 years ago

jetXS commented 9 years ago

Hello,

Regarding backup encryption/decryption, the manifest.plist file seems to be the most important file for an iOS backup, is there anyway to retrieve the manifest.plist file from the iCloud Backup using iloot.py ? I don't know if it's because my downloads are failing to complete but it seems impossible to get hands on the manifest.plist file...

Thank your for your time.

mca-gif commented 9 years ago

The Manifest.plist that you see in iTunes backups likely does not exist in iCloud and isn't currently generated by iloot. But that shouldn't be required for simple forensic or data archive reasons. iloot will make a Manifest.mbdb file, by using the --itunes-style argument. This file allows translating the hashed filenames iTunes makes to real filenames.

If you're trying to take an iCloud backup and restore it to a phone via iTunes, the lack of a Manifest.plist file would not be the only limit to restoring the iCloud backup to the phone from iTunes. Currently the backups that are generated are not full datasets but just the new files present in each snapshot. They aren't a full delta including the deleted files, so you might end up with more files that necessary.

jetXS commented 9 years ago

Well, the thing is that it is not possible to open the backup for analysis without the manifest.plist in a simple software like iExplorer or more complex like Oxygen... I thought that it would be possible but I understand your explanations, my bad. I started to compare a .plist file from an iTunes backup and the rootdomain files of an iCloud backup and, saw a lot of similarities. I thought it might be possible to recreate the manifest.plist file from the rootdomain files. Thank you for your answer anyways. Have a good day.