Micro Web Servers
Copyright 2011 Technoids.com
You must read and accept the terms of the disclaimer to use the contents of Technoids.com
Feel free to reprint any contents of Technoids.com only if a credit is given to Technoids.com
iTunes Backup iOS 5 Database Forensics
iTunes Backup Location
Mac OS ~/Library/Application Support/MobileSync/Backup
Windows %AppData%\Apple Computer\MobileSync\Backup\
iTunes backup file names are a SHA1 hash of the path of the iDevice location and the domain it is located in
The 2 main primary domains are HomeDomain & MediaDomain
Example: sms.db
SHA1 of HomeDomain-Library/SMS/sms.db = 3d0d7e5fb2ce288813306e4d4636395e047a3d28
full path = /private/var/mobile/Library/SMS/sms.db
SMS
3d0d7e5fb2ce288813306e4d4636395e047a3d28
HomeDomain-Library/SMS/sms.db
/private/var/mobile/Library/SMS/sms.db
Call History database
ff1324e6b949111b2fb449ecddb50c89c3699a78
HomeDomain-Library/CallHistory/call_history.db
/private/var/wireless/Library/CallHistory/call_history.db
Safari Bookmarks
d1f062e2da26192a6625d968274bfda8d07821e4
HomeDomain-Library/Safari/Bookmarks.db
/private/var/mobile/Library/Safari/Bookmarks.db
Address Book
31bb7ba8914766d4ba40d6dfb6113c8b614be442
HomeDomain-Library/AddressBook/AddressBook.sqlitedb
/private/var/root/Library/AddressBook/AddressBook.sqlitedb
Notes
ca3bc056d4da0bbf88b5fb3be254f3b7147e639c
HomeDomain-Library/Notes/notes.sqlite
/private/var/mobile/Library/Notes/notes.sqlite
Photo
12b144c0bd44f2b3dffd9186d3f9c05b917cee25
/private/var/mobile/Media/PhotoData/Photos.sqlite
iTunes Store
9143d986a77ab8cf5878e4e9ac80627477eb6674
HomeDomain-Library/com.apple.itunesstored/itunesstored2.sqlitedb
/private/var/mobile/Library/com.apple.itunesstored/itunesstored2.sqlitedb
iTunes Backup Database Forensics
Voice Mail
992df473bbb9e132f4b3b6e4d33f72171e97bc7a
HomeDomain-Library/Voicemail/voicemail.db
/private/var/mobile/Library/Voicemail/voicemail.db
Calendar
2041457d5fe04d39d0ab481178355df6781e6858
HomeDomain-Library/Calendar/Calendar.sqlitedb
/private/var/mobile/Library/Calendar/Calendar.sqlitedb
Flight Stats
970922f2258c5a5a6d449f85b186315a1b9614e9
Facebook
6639cb6a02f32e0203851f25465ffb89ca8ae3fa
Email Account (plist)
5fd03a33c2a31106503589573045150c740721dd
HomeDomain-Library/Preferences/com.apple.accountsettings.plist
/private/var/mobile/Library/Preferences/com.apple.accountsettings.plist
Safari History (plist)
1d6740792a2b845f4c1e6220c43906d7f0afe8ab
HomeDomain-Library/Safari/History.plist
/private/var/mobile/Library/Safari/History.plist
Domains
|
Real File Path
|
For SHA1 File Calculation
|
AppDomain
|
/private/var/mobile/Applications/"SHA1Folder"/....
|
AppDomain-"com.app.name"
|
CameraRollDomain
|
/private/var/mobile/Media/PhotoData/Videos/....
|
CameraRollDomain-Media/PhotoData/Videos/....
|
HomeDomain
|
/private/var/mobile/Library/....
|
HomeDomain-Library/....
|
KeychainDomain
|
/private/var/Keychains/....
|
KeychainDomain-"WhatEverFolderOrFile"
|
ManagedPreferencesDomain
|
/private/var/MobileDevice/ProvisioningProfiles/....
|
MobileDeviceDomain-ProvisioningProfiles/....
|
MediaDomain
|
/private/var/mobile/Media/....
|
MediaDomain-Media/....
|
MobileDeviceDomain
|
/private/var/MobileDevice/....
|
MobileDeviceDomain-"WhatEverFolderOrFile"
|
RootDomain
|
/private/var/root/Library/....
|
RootDomain-Library/....
|
SystemPreferencesDomain
|
/private/var/preferences/SystemConfiguration/....
|
SystemPreferencesDomain-SystemConfiguration/....
|
WirelessDomain
|
/private/var/wireless/Library/....
|
WirelessDomain-Library/....
|
ManagedPreferencesDomain & MobileDeviceDomain are for Enterprise Provisioning /.... is the rest of the path and file name
SHA1 calculation tips of other files possibly not in the iTunes backup