Member Avatar for D.Twomey

I am looking to design a program in Microsoft Visual Studio 2008 in C# obviously in Windows that will read an iPhone backup folder and display some of the main contents, for example the SMS's and the call history.

The main problem I face I think is interpreting the file names and being able to get to the databases because actually reading the SQLite database should be pretty easy

iTunes stores the backup here

\Users\USERNAME\AppData\Roaming\Apple Computer\MobileSync\Backup

I know that iTunes stores the backup files with hex-encoded SHA1 hashes and I don't know how to interoperate this.

For example from the main backup folder there are all the device backups and then the files contained within that backup.

Example

From

Backup Folder --------- Backup Name ------------- A file from in the backup (SMS location)
\Backup\e8d198de26a3c6279c1471f45f34f867b77c6f26\3d0d7e5fb2ce288813306e4d4636395e047a3d28


To
\Backup\Dan's iPhone4\ (and the other files in that directory)

Above is the location of the SMS database but obviously I cannot read that without interoperating the SHA1 hashes of the file

The other important files contained within the backup are
Status.plist
Manifest.plist
Manifest.mbdb
Info.plist


What files do I parse and how to do this?

Sorry if this doesn't make sense to anyone else but it makes sense to me so I can't simplify if without further questions.

Is anyone able to assist me with this?

I greatly appreciate all and any help to writing this program

Dan

  • 2 Contributors
  • 2 Replies
  • 549 Views
  • 1 Day Discussion Span
  • Latest Post Latest Post by D.Twomey

Dani AI

Generated

A short, practical plan that matches what is trying to do and answers ’s SHA‑1 comment:

iTunes backups store each file under a hex SHA‑1 name; that name is produced from the file’s domain plus a dash plus its relative path (for example, "HomeDomain-Library/SMS/sms.db" → SHA1(...)). The manifest files in the backup supply the mapping or metadata you need to reconstruct original names so you don’t attempt to “reverse” SHA‑1 — you either read the manifest mapping or compute the same SHA‑1 string yourself. (theiphonewiki.com)

Recommended workflow (ordered):

  • Open the device backup folder (MobileSync/Backup) and locate the backup GUID subfolder. Check for Manifest.db (SQLite) first; older backups use Manifest.mbdb (binary). Manifest.plist contains overall backup metadata (including the BackupKeyBag and an encryption flag); Info.plist/Status.plist contain device metadata. (richinfante.com)
  • If Manifest.db exists, query its Files table (fileID, domain, relativePath). If only Manifest.mbdb exists, parse it to get domain+relativePath entries and either read fileID or compute SHA‑1("<domain>-<relativePath>"). (stackoverflow.com)
  • Locate the file in the backup (often placed in a subfolder named with the first two hex chars of the SHA1). For SMS, copy the sms.db file and open it with any SQLite client. If the backup is encrypted you must supply the backup password and decode the BackupKeyBag first. (apple.stackexchange.com)

Minimal C# snippet to compute the backup filename from domain+path:

using System.Security.Cryptography;
using System.Text;

string input = "HomeDomain-Library/SMS/sms.db";
using var sha1 = SHA1.Create();
var hash = sha1.ComputeHash(Encoding.UTF8.GetBytes(input));
string fileId = BitConverter.ToString(hash).Replace("-","").ToLowerInvariant();

Use a binary‑plist parser (for example the C# plist libraries on NuGet) to read Manifest.plist and a standard SQLite ADO.NET provider (Microsoft.Data.Sqlite or System.Data.SQLite) to open sms.db. If encountering missing files or gibberish, check Manifest.plist for encryption and follow a BackupKeyBag‑based decryption workflow before inspecting Manifest.db/mbdb. (libraries.io)

Recommended Answers

All 2 Replies

Member Avatar for tgreer

Dan,

Can you define the word "interoperating" in this context? Do you mean, "interpreting"? SHA-1 is a one-way hashing algorithm. You can't convert it back to its "original" string.

Member Avatar for D.Twomey

sorry yes I do mean interpreting - spelling mistake on my part there

I know you can't convert the SHA1 back, doesn't work like that but In one of the main .plist files in the backup all of these hashes and their original names / directories / domains are stored.

If you have even used an iPhone backup recovery tool (or seen) you may understand what I need to do better

This is a screen shot of when the backup looks like in a mac (looks the same in windows just with windows look)
http://twitpic.com/7cdtae

These are a few screen shots from a basic Mac backup reader
http://twitpic.com/7cdthb
http://twitpic.com/7cdtr1

This is the sort of thing I'm looking to create, just don't know where to start with coding the reading of the files
http://www.iphonebackupextractor.com/

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.