iTunes Backup Protocol
Definition
Apple's proprietary protocol for transferring device data to a computer. Used by forensic tools to conduct logical acquisition of iOS devices; backup files are stored in a structured format and may be encrypted with a user-set password.
- Vendor
- Apple
- Acquisition type
- Logical
- Target devices
- iOS devices
- Encryption
- Optional, user-set backup password
Common questions
How does an iTunes-protocol logical extraction compare to a full physical extraction?+
A backup made through this protocol captures app data, messages, photos and settings as structured files but does not recover unallocated space or deleted data the way a physical or file-system extraction can, so it is faster but less complete than a full-image acquisition.
Why does an encrypted backup complicate an examination?+
If the user set a backup password, forensic tools cannot parse the backup contents without that password or a way to bypass it, which can stall an extraction entirely unless the examiner has lawful access to the passcode or a supported workaround.
Related terms
- AFC (Apple File Conduit)
- The iOS service that exposes the media partition for file transfer during synchronisation. In standard form it only surfaces the media partition;...
- Android Debug Bridge (ADB)
- A command-line tool included in the Android SDK that allows communication with an Android device over USB or Wi-Fi. Used for logical...
- File-System Extraction
- A deeper form of extraction that retrieves the full accessible directory tree by mounting the file system or using a privileged API...
- Logical Acquisition
- An extraction method that uses the device's own operating system interfaces, such as iTunes backup or Android Debug Bridge, to export the...
- Trust Relationship (iOS)
- The pairing between an iOS device and a computer established when the user taps 'Trust' after connecting. A forensic logical or file-system...