Manifest.db
Definition
The SQLite database at the root of every iTunes local backup. It maps each backed-up file to its SHA-1 hash filename, recording the domain, relative path, file flags, and modification time. Forensic tools use it to reconstruct the logical directory tree from the flat backup store.
- File type
- SQLite database
- Location
- Root of an iTunes local backup
- Maps
- Backed-up file to its SHA-1 hash filename
- Also records
- Domain, relative path, file flags, modification time
Common questions
Why is Manifest.db essential for reconstructing an iTunes backup's directory tree?+
The backup itself stores files flatly, named only by SHA-1 hash with no folder structure, so without Manifest.db an examiner would see thousands of hash-named files with no way to know which app or path each one came from; the database is what restores the meaningful hierarchy.
Does a corrupted Manifest.db make the backup data unrecoverable?+
The underlying files, still named by hash, remain on disk, so file content is not necessarily lost, but without the mapping table an examiner has to identify files by content or known hash signatures rather than by their original path and domain, which is far slower and less complete.
Related terms
- ADB Backup
- An Android Debug Bridge backup produced by the adb backup command. The output is a TAR archive prefixed by a small plaintext...
- allowBackup Flag
- An Android manifest attribute (android:allowBackup) that controls whether an app's data is included in ADB backups. When set to false the app's...
- Backup Keybag
- A data structure in iOS encrypted backups that holds the per-class encryption keys used to protect individual files. The keybag itself is...
- CLOUD Act
- The Clarifying Lawful Overseas Use of Data Act (US, 2018). Clarifies that US service providers must comply with valid US legal process...
- Domain (iOS Backup)
- A prefix in the iOS backup manifest that identifies the origin of each backed-up file. Common domains include HomeDomain (the device home...