iTunes Backups
Overview
Section titled “Overview”Evidence: iTunes Backups
Description: Collect iTunes Backups
Category: Applications
Platform: windows
Short Name: itnb
Is Parsed: No
Sent to Investigation Hub: No
Collect File(s): Yes
Background
Section titled “Background”iTunes/Apple Devices stores iOS device backups in the MobileSync Backup directory. These backups contain app data, messages, photos, contacts, and device configurations from iPhones and iPads synchronized with the computer.
Data Collected
Section titled “Data Collected”This collector gathers structured data about itunes backups.
Collection Method
Section titled “Collection Method”This collector gathers iTunes backup directories from Apple application data, collecting complete or partial iOS device backups.
Forensic Value
Section titled “Forensic Value”iTunes backups contain extensive mobile device data including messages, call logs, app data, photos, contacts, and location history. This is invaluable for mobile forensics when the physical device is unavailable, revealing communications, activities, and evidence from iOS devices.