Allow access to encrypted local backup?

[AppleTechy]

I have an encrypted backup of my device, I also know the decryption password for this backup. I want to be able to browse the files of the backup in search of some of my configuration profiles I had installed. MY goal is to get to retrieve the Configuration profile and all the payloads that were with installed with it. Just accessing an icloud backup of the device doesn't contain all the needed files. So I need to be able to load in my local encrypted backup and enter in the password. Any guidance on this would be appreciated!

[horrorho]

Hi. This isn't part of InflatableDonkey's functionality. I was going to suggest you take a look at iphone-dataprotection but I see you've already opened a ticket there.

[AppleTechy]

I’m sad to hear that you can’t use local backups. Maybe something in the future??? Most of the other applications seemed to have been abandoned or not that user friendly. I had opened a ticket but some of the dependencies that it seem to require hosting and I couldn’t seem to find them. I had noticed that InflatableDonkey had referenced iPhone-dataprotection so I figured it was a worth a shot trying it. Do you have any guidance on “iPhone-data protection”? I mostly couldn’t find a list of commands and couldn’t find a copy of M2crypt.

On Aug 5, 2017, 2:04 PM -0700, horrorho notifications@github.com, wrote:

Hi. This isn't part of InflatableDonkey's functionality. I was going to suggest you take a look at iphone-dataprotection but I see you've already opened a ticket there. — You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub, or mute the thread.

[horrorho]

@AppleTechy Unless my heavy work schedule changes, it's unlikely I'll have time to add in the functionality for local backups. Sorry.

It may sound rather odd, but I've never owned an iPhone so although I'm familiar with the technical aspects of recovering local backups I've not actually used iphone-dataprotection. I have examined parts of it's code base in detail but that doesn't really enable me to assist you in a useful manner.

I would suggest waiting for a reply to your ticket or maybe you could head over to stackoverflow if you haven't already?

I can leave this ticket open and if anyone would like to chime in it's probably better to reply here.

[AppleTechy]

Any chance you could add support for decrypting local encrypted itunes backups? Or possibly fork This Repo?

[dunhamsteve]

I have Go code to do this, but it's not particularly user friendly. It was just written for my own use, poking around in my backups and their keychains. I published it in case it was of use to someone else.

If you have Go installed, you can do:

go get github.com/dunhamsteve/ios/cmd/irestore

It will build an executable called irestore. Running irestore will list your backups. You can then do something like:

irestore UUID_HERE restore \* outdir

to extract your full backup. (There are also commands to list files, extract the keychain, etc.)

Apple has some expensive key derivation on the backups - it takes a good ten seconds or so on my iMac to turn a password into a key. If you want it to go faster, the app prints a hex key that you can use instead of your password.

[AppleTechy]

@dunhamsteve Awesome thanks! Up to what IOS version does it support?

[dunhamsteve]

It should work with 10 and newer (except maybe for the early point release of iOS 10 with the security issue). I try to keep it up to date. I also try not to break compatibility with older versions, but don't do a lot of testing with my older devices. I ran it on an iOS 11 backup to double-check the instructions above.

(I don't have a lot of interest in cloud backups at the moment - I don't trust them. But I happened across this repository because I was curious about CloudKit's wire protocol.)

[AppleTechy]

@dunhamsteve So what passwords do I need? Just the encryption password for the backup? Or the device password as well? And is there anyway to tell it where to find the backup, since I will be transferring the backup over from a different machine than the one I will be running the decryption on?

[dunhamsteve]

Just the password that was set in iTunes when encrypted backups were turned on.

It's going to look in "~/Library/Application Support/MobileSync/Backup". Within that directory, there will be one or more directories whose name is a hex number (the id of the device). Inside that directory should be a bunch of files including something about a "Manifest".

(BTW - If you're using a recent version of go and don't configure anything, the executable will probably end up in ~/go/bin.)