Help & support recovering iPhone backups
What does the iPhone Backup Extractor do?
The iPhone Backup Extractor can extract files from iTunes and iCloud backups of your iPhone, iPad, or iPod Touch data. It works with iOS 1, 2, 3, 4, 5, 6, 7 and 8.
Information about iTunes iPhone, iPad and iPod Touch backups
support.apple.com: “iPhone and iPod touch: About backups”
- support.apple.com: “Backing Up, updating, and restoring your iPhone and iPod touch software”
iCloud backups: where & how
Apple iCloud provides Apple users with storage space to back up the content of their iDevices. It currently offers a 5 GB free storage and up to 50 GB paid storage.
An iCloud backup runs daily when your iDevice is connected over the Wi-fi, to the Internet, plugged into a power source, locked or when you force Create a backup directly from the iDevice: Settings > iCloud > Storage & Backup > Back Up Now.
To manage your iCloud storage you can easily do that from your iDevice: Storage & Backup > Manage storage.
iCloud backups are stored in Microsoft (Azure) and Amazon (AWS) clouds in encrypted form and Apple holds the encryption keys to access data from your iCloud backup. An iCloud backup always contains the last 3 stored backups or snapshots (incremental backups for faster downloading).
What gets backed up in an iCloud backup
Documents, notes, calendar, photos, videos, safari, messages (including iMessages), Call history, app data, device settings, mail, network settings (vpn settings, saved wi-fi hotspots etc), and much more.
So, if you may want to browse your iCloud backup data without the actual iDevice, get access to a specific data that can be read offline on a PC or get close to realtime data (SMS, iMessages, mail, call history, photos etc) download your iCloud backup directly on your computer with the iCloud Backup download feature (Windows only) of the iPhone Backup Extractor (available for both Windows and Mac OS X).
Retrieve and decrypt iCloud backups
To download data from iCloud you will need your Apple ID and password in order to authenticate and access your iCloud data to download. Note that your iCloud authorization time will expire in one hour time.
iPBE's iCloud Backup download feature downloads the 3 snapshots and a complete iCloud backup and converts them to an iTunes Backup format so you can access your iCloud backups offline from your PC. The iCloud backups are downloaded in the iTunes backup default folder.
Note: The iCloud backups that aren’t completely created will not be listed as available for downloading.
The iPhone Backup Extractor also rebuilds deleted sms and notes and if you are looking for forensic tooling, bulk recovery or others, we have a series of advanced services and tools available to our enterprise partners. Contact us for pricing and availability.
What can be done with encrypted backups?
The Pro edition of the iPhone Backup Extractor includes full encrypted backup support. The Free and Home editions limit users to extracting only four files.
Can I use the iPhone Backup Extractor on a computer without iTunes?
The iPhone Backup Extractor will automatically search in the default iTunes backup location for your backups. However, the software doesn't require that iTunes is installed on the computer on which you use it. You can copy your backups to another machine and use the iPhone Backup Extractor there. It is possible to extract on Windows from a backup made under OS X, and vice-versa.
Where does iTunes store its backups?
Under OS X, iTunes will store backups in
Under Windows XP, iTunes will store backups in
\Documents and Settings\USERNAME\Application Data\Apple Computer\MobileSync\Backup.
Under Windows Vista, Windows 7 and Windows 8 iTunes will store backups in
Why are the filenames garbled?
iTunes stores the backup files with hex-encoded SHA1 hashes. These names are constant between all backups. We've summarised the filenames of some of the more important backup files, in case you need to get manual access to them. Access through the iPhone Backup Extractor interface should be simpler in all cases.
|Contents||iOS||Real filename||Backup filename||Type|
|SMS / Text messages||1-7||sms.db||SQLite 3|
|Contacts / address book||1||AddressBook.sqlitedb||SQLite 3|
|Contacts / address book||2-7||AddressBook.sqlitedb||SQLite 3|
|Call history||1||call_history.db||SQLite 3|
|Call history||2-3||call_history.db||SQLite 3|
|Call history||4-7||call_history.db||SQLite 3|
Are data recovered with the iPhone Backup Extractor forensically sound?
Yes, they are. The files are not manipulated in any way in the backup or reading process. As well as a number of private forensics and recovery agencies, we have police and state forensics labs using our software around the world, from US Congress-funded law enforcement training programmes to the UK South Yorkshire Police, the German Polizei Hamburg Forensische and the Danish National High Tech Crime Center.
How can I recover text messages, notes or contacts which were deleted prior to the backup being taken?
The iPhone Backup Extractor extracts data from iPhone backups. As such, so long as the last backup was taken before the data was deleted, it will recover your information automatically. However, if the data was deleted before your backup was taken, it makes sense that the backup won't contain your data. Fortunately, Apple don't purge deleted data from their database files, so it is often possible to recover some deleted SMS, note and contact data. By extracting the SQLite databases from your backup in Expert mode, and opening them in Notepad, you should see fragments of any data that has been deleted. This isn't the easiest way to recover data, and reassembling contact information isn't easy, but it's better than losing the data altogether! Registered users who need to do this can send us their SQLite databases and we can extract the textual information for them, although we cannot guarantee its legibility or use.
Restoring extracted files to my iPhone
Importing contacts from VCard or VCF
Importing your contacts into Outlook, Google Mail, or other modern email systems is easy. Our blog describes how to import your iPhone or iPad VCard contacts into Google Mail.
Importing contacts from CSV
There are instructions on how to import your contacts from CSV to Gmail and Outlook. Almost all contact management software will support import from CSV. Our blog describes in more detail how to import your iPhone or iPad CSV contacts into Outlook.
The contacts CSV files are generated with the following fields: Title, FirstName, MiddleName, LastName, Suffix, Nickname, Company, Department, JobTitle, Note, Birthday, WorkPhone, WorkFax, MobilePhone, HomePhone, OtherPhone, SpousePhone, MainPhone, Pager, Url, Tag, Email, Street, City, State, Zip, Country, CountryCode.
Importing contacts directly onto your iPhone, iPod Touch or iPad?
If you don't synchronise your iPhone with an email or contacts client, it is possible to restore contacts to an iPhone by simply emailing a VCard file to the phone. Once the phone has received the email, open the VCard attachment and an option to import the data will be shown.
Restoring other files
Restoring other types files to your iPhone can be tricky without technical know-how. Depending on the type of file, we've listed below the tricks we'd try to get data back onto a new phone. We cannot endorse or guarantee any of these methods, and they may break your phone:
- Load it into Outlook, webmail, iTunes, MobileMe etc. and sync with your iPhone
- Save your old iTunes backup somewhere, get iTunes to take a new backup of your upgraded phone, then patch the new backup with files from the old backup and restore the new backup onto the phone. See “restore SMS history from one phone to another”
- Jailbreak the iPhone, SSH in and manually update the databases with SQLite once in
- Jailbreak the iPhone and manually replace the files with SCP
- Install a third-party piece of sync software like Syphone (Mac only)
- Install a Wifi "shared drive" app (AirShare, DataCase, etc.) on the iPhone and try to replace the files directly
Working with Apple's database files directly
Users of the registered version of the iPhone Backup Extractor are able to use its function to automatically export their data to CSV for easy access.
Non-registered users cannot, and will find that they need to manipulate Apple's
Both of these files are SQLite 3 databases. Users wishing to extract data from these files will need a SQLite database client.
How can I work with SQLite databases?
Users might want to try either of these two free applications:
How can I query out the data from my iTunes SQLite backup?
As an example, to manually extract contact data, users should restore "Libray/AddressBook/AddressBook.sqllitedb", and then open the restored file with the SQLite Browser. Choosing the "Execute SQL" tab, paste this into the "SQL string" field:
SELECT ABPerson.first, ABPerson.last, ABMultiValue.value FROM ABPerson, ABMultiValue WHERE ABMultiValue.record_id = ABPerson.ROWID
Pressing the "Execute Query" button should return the full contact list shown in the "Data returned" field.
To extract SMS data, users should restore the file "Libray/SMS/SMS.db", open the restored file with the SQLite Browser browser, choose the "Browse data" tab, and then select "message" from the "Table" drop-down. On clicking the magnifying glass button, users should their full SMS history shown in the "Data returned" field.
The date and time fields just come back as numbers, how can I interpret them?
You may struggle to intrepret a number of the fields in the databases, and the registered version of the iPhone Backup Extractor can extract the data automatically for you. However, if you're going it alone, you should find the
dates are represented as either the number of seconds since 1/1/2001, or 1/1/1970, depending on the position of the date field. In Excel, you could use a formula such as
=1/1/2001 + A1/60/60/24 where A1 is your time data.
You may also need to adjust the value to account for your local timezone.
If you're struggling to do something particularly complicated with your iTunes backup, the following resources might help:
- How to decrypt encrypted backups (open question)
- iPhone Forensics: Recovering Evidence, Personal Data, and Corporate Assets (book)
- Macintosh OS X, iPod, and iPhone Forensic Analysis DVD Toolkit (book)
- Hampton Road Geek community on “Stupid iPhone Tricks”
- Recover data from an iPhone backup
- Guide: Change iPhone Calendar Colors Manually
- Apple iPhone Support Home
- Apple iPhone Support Forum
Reincubate was founded in 2008 and has offices in London and Bucharest. We have a range of popular desktop applications including the iPhone Backup Extractor, awdit and the BlackBerry Backup Extractor. In any given month our applications are downloaded more than 120,000 times, and our sites receive more than 4,000,000 impressions.
We have licensed our software to an impressive array of law enforcement, government and security organisations in the US and internationally, and to corporations including Microsoft, Apple and IBM. You can learn more about Reincubate at reincubate.com.