iTunes Backup Explorer

iTunes Backup Explorer is a graphical open-source tool that can show, extract, and replace files in iPhone and iPad backups.

It supports both encrypted and non-encrypted backups, currently from iOS 10.2 onwards.

Most programs that support encrypted backups are either limited trials or expensive. There are apparently only very few open-source projects that target this issue and none that are also useful for the average user.

Installation

• Open your terminal and type in java -version.
• If the command was not found or the version is below 11, download and install Java for your operating system, e.g. from here.
• Download the jar file of the latest release of iTunes Backup Explorer.

Windows

• Simply double-click the downloaded file to start the program.
• From the command line: java -jar JARFILE.jar. Replace JARFILE.jar with the name of the file you downloaded.

macOS

• cd to the download directory and type in chmod +x JARFILE.jar.
• You may need to enable Full Disk Access in System Preferences -> Security -> Privacy for the Jar Launcher or Terminal.app / iTerm.app.
• Now, you should be able to simply double-click the file to start the program.
• If that does not work, you may need to type java -jar JARFILE.jar into the terminal to run it.

Linux

• cd to the download directory and type in chmod +x JARFILE.jar.
• Depending on your specific system, you should be able to double-click the file to start the program.
• If that does not work, use java -jar JARFILE.jar to run it.

File Search

In the "File Search" tab, you can search for files using case-insensitive SQLite LIKE syntax. It supports two wildcards: % and _.

• % matches any sequence of zero or more characters.
• _ matches any single character.
• \ is used as the escape character.

Here are a few examples:

	Domain	Relative Path
Videos in the camera roll	CameraRollDomain	%.mov
Files under the DCIM directory	CameraRollDomain	Media/DCIM/%
All .sqlite files	%	%.sqlite
.db databases in the home domain	HomeDomain	%.db
All WhatsApp files	%whatsapp%	%
App documents on iCloud	HomeDomain	Library/Mobile Documents/iCloud~%
All files (can take a bit of time)	%	%

After you clicked on the Search button, you can also sort by clicking on a column name.

To find the largest files, type in a query, click on Search and then twice on Size.

With the Export matching button on the bottom right, you can export all files that match your query to a directory you choose.

By right-clicking on a file row, you can open, extract, replace or delete a single file. This works the same as in the hierarchical "Files" tab. If it is a symbolic link, you can show the target location.

Privacy

For me, this was a matter of course, but it was pointed out that I should clarify it anyway. I do not collect any personal data. In fact, the program does not even use an internet connection at this time. If that should change at some point in the future, I will update this notice.

Credits

I started looking into this after I saw this brilliant answer on StackOverflow by andrewdotn to a question that has already been viewed more than 220.000 times. It explains in detail how iOS backups are structured and how they are encrypted, even providing a working code example.

So a huge thanks to him,

his sources iPhone Data Protection in Depth, iOS Hacker's Handbook, a GitHub comment, the iphone-dataprotection project and the Apple iOS Security Guide for iOS 11 (in the Web Archive)

and Forensic Analysis of iTunes Backups by Jack Farley