Domain (iOS Backup)
Definition
A prefix in the iOS backup manifest that identifies the origin of each backed-up file. Common domains include HomeDomain (the device home directory), AppDomain-[bundle ID] (a specific app's sandbox), and MediaDomain (the media library). The domain and relative path together reconstruct the original file location.
- Location
- iOS backup manifest metadata
- Common domains
- HomeDomain, AppDomain-[bundle ID], MediaDomain
- Function
- Identifies each backed-up file's origin
- Used with
- Relative path, to reconstruct original file location
Common questions
Why can't an examiner just browse an iOS backup like a normal file tree?+
Apple stores backed-up files as SHA-1 hashed filenames inside a flat directory structure, not under their original names or paths. The domain and relative path recorded in the manifest database are what let a forensic tool map each hashed file back to its true origin, such as a specific app's sandbox or the camera roll.
What does an AppDomain entry tell an investigator about an app?+
The bundle ID in an AppDomain-[bundle ID] entry identifies exactly which installed app owns that file, which is useful for confirming an app was present on the device and for locating its private data, such as chat databases or cached media, even after the app has been deleted from the phone itself.
Related terms
- ADB Backup
- An Android Debug Bridge backup produced by the adb backup command. The output is a TAR archive prefixed by a small plaintext...
- allowBackup Flag
- An Android manifest attribute (android:allowBackup) that controls whether an app's data is included in ADB backups. When set to false the app's...
- Backup Keybag
- A data structure in iOS encrypted backups that holds the per-class encryption keys used to protect individual files. The keybag itself is...
- CLOUD Act
- The Clarifying Lawful Overseas Use of Data Act (US, 2018). Clarifies that US service providers must comply with valid US legal process...
- Manifest.db
- The SQLite database at the root of every iTunes local backup. It maps each backed-up file to its SHA-1 hash filename, recording...