Introduction

I wanted to see the files on my iPhone on my computer, so I restored the files that were created when I backed up my iPhone with iTunes. The reason was that I wanted to be able to see talks and photos from my PC in case the LINE data disappeared when migrating the iPhone. I use Windows, but Windows has apps that directly reference the contents of the iPhone. However, I didn't trust it so much and I didn't want to access the iPhone directly, so I searched for a way to restore the backup file.

The environment is as follows.

Windows10
iOS 13
iTunes 12.20

Backup file location and configuration

place

When you back up your iPhone with iTunes, a backup file will be created in the following folder. Note that you need to make sure you don't "encrypt" when backing up with iTunes.

C:\Users\[username]\Apple\MobileSync\Backup\XXXXX

"XXXXX" is a character string that seems to be different for each environment. If you have multiple backups, you have multiple folders. Note that iOS (iTunes?) A while ago has a different folder location.

Constitution

The iPhone backup data is contained in the above "XXXXX" folder. The main files are as follows.

Manifest.db DB file in SQLite format. Information on each file is listed. The file path in the iPhone and the file name in the backup folder are linked.
data The original file in the iPhone has been replaced with a 40-character random (some hash value?) File name and placed. Each file is distributed and stored in the folder of the first two characters of the file name. If you don't encrypt it with the iTunes option, the contents of the file will remain the same, so you can see the data by opening it with an editor or viewer.

There seems to be some other information, but I haven't analyzed it any further.

Python script to restore

I created a Python script that outputs the original filenames for all backup files. Error handling is not done properly.

--Since it was created with Python 3.7 on Windows, it is necessary to change the path delimiter on Mac. I'd like to change'\\' in the source file to'/', but I haven't tried it except on Windows. --You can do this by replacing src_basepath with the path in your environment. --The file is created in the ʻoutput` directory.

`restore.py`


import os
import shutil
import sqlite3


#Divide the path into a directory and a file name
#(Example)
# Input: '.\\output\\Library\\Logs\\test.log'
# Output: ('.\\output\\Library\\Logs\\', 'test.log')
def get_dst_filepath(relative_filepath):
    path_array = relative_filepath.split('\\')

    dst_path = ''
    for direcoty_name in path_array[0:-1]:
        dst_path += direcoty_name + '\\'

    filename = path_array[-1]

    return dst_path, filename


#Path definition
src_basepath = r'C:\Users\username\Apple\MobileSync\Backup\00000000-0000000000000000'
dst_basepath = r'.\output'
db_filepath = src_basepath + '\Manifest.db'

#DB connection
connection = sqlite3.connect(db_filepath)
cursor = connection.cursor()
cursor.execute('SELECT fileID, relativePath, flags FROM Files')
result = cursor.fetchall()
connection.close()

###DB field description#######################
# fileID:File name in the backup directory
# relativePath:Relative path
# flags = 1:The original file exists in the backup directory
# flags = 2:The original file does not exist in the backup directory
#############################################

#Processing for each file
for row in result:
    src_filename = row[0]
    dst_relative_path = row[1].replace('/', '\\')
    src_exists = row[2] is 1

    src_filepath = src_basepath + '\\' + src_filename[0:2] + '\\' + src_filename
    dst_filepath, dst_filename = get_dst_filepath(dst_basepath + '\\' + dst_relative_path)

    #Skip if the original file is not in the backup directory
    if not src_exists:
        continue

    print('{}\t{}\t{}'.format(src_filepath, dst_filepath, dst_filename))

    try:
        #Recursively create directory
        os.makedirs(dst_filepath, exist_ok=True)
        #Copy file
        shutil.copy2(src_filepath, dst_filepath+'\\'+dst_filename)
    except :
        pass

The contents of the file, etc.

For reference, list the paths of some files.

--Photo file: Media \ DCIM --LINE data (talk): Library \ Application Support \ PrivateStore \ XXXXXXXXXXXXXXXXXXXXXXXXXXXXXX \ Messages \ Line.sqlite --LINE data (message attachments such as photos): Library \ Application Support \ PrivateStore \ XXXXXXXXXXXXXXXXXXXXXXXXXXXXXX \ Message Attachments \

References

I looked it up about 5 years ago, so I don't remember the URL I referred to. The location and file structure of the file examined at that time are different from now.

Restore iPhone backup file