0

I'm trying to parse an iOS 5, iTunes 10.5 backup manifest.mbdb. The iOS 5, iTunes 10.5 backup no longer maintains a manifest.mbdx file which, in previous versions, was used to locate files in the backup. Padraig answered a related stackoverflow question with:

"The hex file name in the backups folder is the SHA1 hash of the file path appended to the domain, with a "-" in between. So the hash of 'DomainName-/path/filename.png' will match to the correct file."

So, we've tried SHA-1 hashing numerous combinations of DomainName-/path/filename, using the applications path and file information from the manifest.plist and manifest.mbdb - none of which have yielded the name of a file in the backup folder.

For example, the SHA-1 hash of:

com.company.MyApp-/var/mobile/Applications/A7F76BBE-3707-40F5-ACCC-72648EBA71CF/Documents/MyRecording.aac

is 50b28a991eb23e0414436c209dbd6e70ab2b0a82 but no file with this name is in the backup folder.

What specifically should I be using for the the 'path' following the domain- (com.company.MyApp) and before the target filename?

Thank you

bootstrap347
  • 11
  • 3
  • I have updated the Python code to handle this, see the article: http://stackoverflow.com/questions/3085153/how-to-parse-the-manifest-mbdb-file-in-an-ios-4-0-itunes-backup – Robert Munafo Nov 12 '11 at 01:58

2 Answers2

1

Ok, I finally figured out the correct path and hash.

You must have "AppDomain-" + the DomainName (e.g. com.company.appname) + "-" + path (with no \ or / before it) + filename. SHA1 hash that (yes, SHA1 not SHA) and you have a filename in the backup folder.

This combination works, everytime, for every file I need access to.

bootstrap347
  • 11
  • 3
0

After saving

com.company.MyApp-/var/mobile/Applications/A7F76BBE-3707-40F5-ACCC-72648EBA71CF/Documents/MyRecording.aac

into a text file and running

cat ~/Desktop/test.txt | openssl dgst -sha

I get a hash of 173048e3d6ca10c5370a1ca54a26148ed05641d1

Does this file exist in your backup? Perhaps you are running the hash incorrectly?

Edit: Ah, I see that the hash you posted is the SHA1 hash and the correct one is just plain SHA. I will update my original answer on the other thread.

Padraig
  • 1,569
  • 2
  • 15
  • 21
  • Thanks Padraig. But neither the SHA hash nor the SHA1 hash of various combinations of my DomainName- plus path plus filename taken from the Manifest.mbdb generates a string that is the name of any file in the backup folder. – bootstrap347 Oct 27 '11 at 19:53
  • The SHA is definitely the correct one. Are you sure that your iPhone is backing up to iTunes and not iCloud? – Padraig Oct 28 '11 at 14:01
  • I am certain. I can see the freshly backed up files in the backup folder with todays date. I take my DomainName add a "-" and append THE path and filename which I get from the the Manifest.mbdb (also created today). I generate a STA hash of this (see details in email I sent you) using the OpenSSL utility, however the resulting hash does not equal the name of any backup file. So, again, what exactly is appended to my DomainName- for the "path" for iOS 5? – bootstrap347 Oct 28 '11 at 15:30
  • I'm afraid I can't help. The path is the file path from the MBDB file. I use this in my iPhone Backup Extractor at http://supercrazyawesome.com/ if you want to try that out. – Padraig Nov 01 '11 at 16:16