MOBILE FORENSICS

Forensic analysis of iTunes and Finder backups

Local backups created using iTunes or the Finder often represent an important source of data in iPhone forensics. Depending on the type of backup, they contain a wealth of user data and app artefacts that can be analysed without direct access to the device.

Contacts
News
Call logs
Photos and metadata
App data
Safari artefacts
Notes
Calendar
Device settings

TECHNICAL BACKGROUND

Technical Fundamentals

Local iPhone backups can be created either encrypted or unencrypted.

Typical content:

  • •Contacts
  • •News
  • •Call logs
  • •Photos and metadata
  • •App data
  • •Safari artefacts
  • •Notes
  • •Calendar
  • •Device settings

Encrypted backups may – provided the password is known – contain additional data that is not available in unencrypted backups.

OUR APPROACH

This is how your examination will be carried out

A transparent process – from the initial enquiry to the handover of the report.

1
Before the analysis begins, we check what type of backup is involved and whether encryption was used. The artefacts contained therein are then examined using recognised forensic tools and through manual analysis. All results are documented in a reproducible manner and evaluated within their technical context.
2
LanCologne produces expert reports for private individuals, as well as for companies and solicitors. Our reports have already been used in court proceedings. In some cases, we have been directly commissioned to produce IT forensic reports. Upon request, we can provide anonymised or redacted sample reports or extracts.

TYPICAL QUESTIONS

When is this analysis required?

  • ✔What data does a backup contain?
  • ✔What are the differences between Finder and iTunes?
  • ✔What are the benefits of encrypted backups?
  • ✔Which artefacts can be analysed?
  • ✔Can a backup completely replace a device?

LIMITATIONS & CONCLUSION

What you should know

A backup does not necessarily contain all the data on an iPhone. The scope depends on the type of backup, the settings selected and the encryption. Any missing data cannot be recovered at a later date.

The analysis of local iTunes and Finder backups is a key component of iPhone forensics and, in many cases, enables a detailed examination of relevant user and system data.

CUSTOMER REVIEWS

What our customers say

4.8 out of 5 stars on Trustpilot · 54 reviews

★★★★★

“The highest standards of professionalism, prompt service and excellent communication. They made the seemingly impossible a reality. This is what genuine customer service is all about – unrivalled in Germany!”

idalein

Verified review on Trustpilot

★★★★★

“Very helpful advice, excellent responsiveness and communication. My problem was completely resolved and the lost data was recovered. I’m very satisfied and, of course, relieved!”

Layla Pankratz

Verified review on Trustpilot

★★★★★

“My problem was sorted out professionally and quickly; everyone I spoke to was always friendly, and I can still get in touch if I have any questions – I’m very grateful for that!”

a woman from Cologne

Verified review on Trustpilot

Enquire now – free initial consultation

Would you like to have an iTunes or Finder backup examined by professionals? LanCologne can assist you with an objective IT forensic analysis and comprehensive documentation.

RELATED TOPICS

You might also be interested in

FREQUENTLY ASKED QUESTIONS

Frequently Asked Questions

Click on a question to see the answer.

What is the difference between iTunes and Finder backups?
The backup data is essentially the same; since macOS Catalina, it has been managed via the Finder.
Are encrypted backups better?
They may contain additional data, provided that it can be decrypted.
Can a backup be examined without the iPhone?
Yes, provided the backup is available and can be analysed technically.
Does it contain deleted data?
That depends on when the backup was taken and what it contains.
Can an expert report be drawn up?
Yes, provided that this forms part of the contract.