Extracting the logical information from the iTunes backup is crucial for forensics investigation. There is a full stack of tools available for extracting data from the iTunes backup. They come in a wide variety, from open source to paid tools. Some of these forensic tools are Oxygen Forensics Suite, Access Data MPE+, EnCase, iBackup Bot, DiskAid, and so on. The famous open source tools are iPhone Backup Analyzer and iPhone Analyzer. In this section, we are going to learn how to use the iPhone backup extractor tools.
The iPhone backup extractor is an open source forensic tool that can extract information from device backups. However, there is one constraint that the backup should be created from iTunes 10 onwards. Follow these steps to extract data from iTunes backup:
Download the iPhone backup extractor from http://supercrazyawesome.com/.
Make sure that all your iTunes backup is located at this directory:
~/Library/ApplicationSupports/MobileSync...