Default post cover image

iOS data recovery: where do apps store data in iPhone backups?

Aidan Fitzpatrick

by Aidan Fitzpatrick

This article will help you find files belonging to a particular app inside an iPhone backup. It'll also help you build a better understanding of how files and folders are arranged on iOS.

Where do apps store data in iPhone backups?
Where do apps store data in iPhone backups?

The simplest approach for recovering files from and iOS backup is to use iPhone Backup Extractor: the free edition will help you find and extract the files you need, as it can do so without you needing to know the detail in this article. If you’d like to do that, you’ll find we’ve got a number of handy guides shown in the top menu of this site, which will guide you through that process.

Understanding expert mode and iOS domains

When building apps for iOS, authors have a number of decisions to make around how and where they store data. (We’ve written separately on the trade-offs app authors face in deciding where to store user data.) The best way to explore and build familiarity where each app stores its files in iOS is to use the free edition of iPhone Backup Extractor. If you load it up, select a backup in the left hand navigation menu, and then choose “Expert Mode” from the main part of the screen, you’ll be presented with a list of around 18 folders, likely beginning with “Application Groups”. Strictly speaking, these top-level groupings are known as “Domains”.

Many domains are only tangentially used by apps. For instance, the “Keyboard” domain may have some data from third-party keyboards, but not from regular apps.

Some domains -- such as “Media” and “Camera Roll” -- are used heavily by the built-in Messages and Camera apps. However, it’s the “Application Groups” and “Applications” domains that we’re most interested in when tracking down data from third-party apps.

What’s in a namespace?

If you expand the “Applications” domain to list the folders it contains, you’ll see a number of strangely named folders. Here’s an example:

  • com.apple.Health
  • com.burbn.instagram
  • com.facebook.Messenger
  • snapchat.picaboo
  • com.spotify.client

Performing iOS data recovery from apps with iPhone Backup Extractor
Performing iOS data recovery from apps with iPhone Backup Extractor

These folders are the primary place for an app to store its data, and they’re usually named using the same format. Back in 1996, Sun Microsystems published a programming language named Java. Java’s documentation laid out a way for third party software publishers to publish their software without it conflicting with other authors' software. The trick was to take the name of the company’s site -- such as apple.com -- and to reverse it, before adding the name of the product. Thus, Apple’s Health app falls under com.apple.Health, and iPhone Backup Extractor rightly belongs under com.reincubate.iPhoneBackupExtractor. These names became known as “namespaces”, and Sun published a number of additional rules for them.

Apple adopted this as a best practice when designing iOS. Of course, the naming standard is only a guideline. As you can see in the example of Snapchat (snapchat.picaboo), not everyone plays by the same rules. This isn’t necessarily a bad thing, but consistency can be helpful when one is trying to recover data!

In some cases, an app’s namespace can reveal an interesting historical quirk. Instagram’s namespace is com.burbn.instagram because, well… back in 2010, Instagram was known as Burbn.

Where do popular iOS apps store their data?

The following table shows the namespaces for a number of popular iOS apps. Don’t forget, iPhone Backup Extractor has this list built into it (and it knows about the changes between different versions of the apps, and of iOS), so it always knows where to look when assisting you with recovering iOS data.

App iOS namespace
Facebook com.facebook.Facebook, com.facebook.Messenger
Instagram com.burbn.instagram
Snapchat snapchat.picaboo
Messages Home/Library/SMS
Spotify com.spotify.client
Pinterest pinterest
Skype com.skype.skype
Shazam com.shazam.Shazam

If you’d like to know where a particular app stores its data, and it’s not on this list, why not tweet us @reincubate? We’ll let you know. 👩‍🔬

How do iOS apps store their data, and how can it be read?

App authors are free to store data in whichever format they like in their applications. Users of iPhone Backup Extractor will tend to run across three formats if hunting for data manually in their backups:

  • XML Plists
  • Binary Plists
  • SQLite databases

Both XML and binary Plists are often identified by having the “.plist” file extension. However, many other extensions can also indicate a file being a Plist, such as “.cookies”. Plist is an abbreviation of “Property list” and they are Apple’s preferred file format for storing a collection of simple data. XML Plists can usually be read by eye, as they are stored in plain text, but binary Plists aren’t normally understandable if plainly viewed.

Fortunately, the free edition of iPhone Backup Extractor has a Plist viewer and editor built-in: choose “View/Edit Plist” from the File menu, and you’ll be able to examine the contents of any Plist file. Alternately, in Expert mode, users can right-click on a file and choose “View as Plist”.

View as Plist in iPhone Backup Extractor
View as Plist in iPhone Backup Extractor

SQLite databases are what you might expect: collections of structured data. They are often indicated by “.db” or “.sqlite3” file extensions. These files can’t be read without a special editor, but iPhone Backup Extractor has the technology to query them for you.

What does each domain contain in an iPhone backup?

iOS backup domain Data found in this domain
Application Groups Data stored here by apps is able to be shared slightly more freely on the device. Many applications will store a small amount of data here, but rarely will you see valuable content.
Application Plugins Apps that store data here usually do so as part of an iOS extension. That may be as a Watch plugin, a third party keyboard, a widget, a sharing extension, or an Animoji. This domain rarely contains user data.
Applications This is the core domain for apps to store user data on an iPhone. Each app has its own namespace, as described in the “What’s in a namespace?” section above.
Camera Roll The camera roll domain includes all photos, videos and metadata stored on an iOS device. If the device is configured to “Optimise Storage”, and not to store all photos locally, this domain may contain less information than one expects.
Databases Little information is stored here on modern installs of iOS.
Health HealthKit and medical data is store in the Health domain, along with activity data being shared with a paired Apple Watch.
Home The Home domain is a goldmine of information for many of Apple’s built-in applications, such as Messages, Notes and Calendar.
HomeKit This domain stores a limited amount of information on the state of Apple HomeKit configuration.
Install The Install domain contains metadata to indicate which built-in Apple apps are installed on the iOS device.
Keyboard Language and keyboard configuration is stored in this domain.
Keychain The iOS device’s keychain (a collection of user passwords) is stored here, in a SQLite file.
Managed Preferences This domain contains data around the management of the iOS device. If your device is enrolled in an MDM (mobile device management) program, perhaps by your school or employer, some metadata will be stored here.
Media Many types of media are stored under this domain. For instance, users will find attachments to SMS messages, recordings, and PhotoStream data here.
Root The root domains contains fundamental configuration files for the setup of the iOS device.
System Containers The system containers domain contains limited metadata from the App Store app, and some other iOS processes.
System Preferences This domain contains low-level information on an iOS device’s status. For instance, you can learn about its networking configuration, or about the wi-fi networks or VPNs it has recently connected to.
System Shared Containers Some iOS system processes which can share data across iOS store their data here. It is a good place to start when looking to learn more about Bluetooth activity on a device, for instance.
Wireless The wireless domain contains a rich set of information on iOS’s use of cellular and wi-fi networks, and of its recent IP address assignations.

What to do next

Why not download iPhone Backup Extractor, or read more about Reincubate and how we help customers around the world recover their data?

If you’d like to learn more about iOS or iPhone Backup Extractor, this site has a rich set of guides and articles on making the most of your data. Our support centre contains a number of additional knowledge-base pieces with answers to frequently asked questions.

Aidan Fitzpatrick

by Aidan Fitzpatrick on

We've helped over 3,000,000 people recover their lost iPhone data. Let us help you too.

Submit a comment

© 2008 - 2018 Reincubate Ltd. Registered in England and Wales: #5189175, VAT GB151788978. Built with ❤️ in London.

Reincubate is a registered trademark. All rights reserved. Terms & conditions. Privacy Policy. It's your data, not ours. We recommend 2FA.

close

For personal users

For businesses and pro users

Scroll down for business and pro plans

Basic

$34.95

iTunes support

Works with Windows and Mac

Customer support

Preview iCloud device list

BUY BASIC

Premium

$69.95

iCloud and iTunes support

Works with Windows and Mac

Customer support

5 iCloud devices

BUY PREMIUM
Jonathan

This is iPhone Backup Extractor, think of it as a "personal forensics" utility. It's pretty awesome.

Jonathan Zdziarski

Forensics and iOS expert

For business and pro users

Business

$299.95

25 iCloud devices

High priority customer support

Commercial license

All benefits of our premium plan

BUY BUSINESS
ricloud
Demo our APIs for enterprise

Need iCloud API access, forensic tools, bulk recovery of deleted SQLite data?

Learn about our APIs at reincubate.com.