How to read itunes backup file (Manifest.db)

Question

I'm trying to read and analysis iPhone backup files in Library/Application Support/MobileSync/Backup folder.

I use SQLite DB viewer to view the manifest.db:

Files TABLE structure

Files TABLE content

The filename is encrypted. And the file is blob type which I can't decide it's an image or text or documents.

How can I get the details of these backup? (Using Javascript would be best, or Swift).

Answer 1

The numbers and letters under fileID are the file names in the backup as in the folders with the manifest.db, and they correspond to the domain and relative path (duh). In iOS versions newer than 9.3.5, you can find the file itself in the folder named with the 1st 2 characters of the fileID. At the end of the relative path in the database it should have an extension. Use that as a hint to what program to use to open the file. Xcode for .plist etc. Ultimately it depends what you're looking for...

Answer 2

The blob in the blob column is a binary plist. You can parse it using a plist parser e.g. Property List Parsing