The manifest.plist file describes the contents of the backup and typically contains the following information:

  • Backup keybag: The Backup keybag contains a set of data protection class keys that are different from the keys in the System keybag, and backed-up data is re-encrypted with the new class keys. Keys in the Backup keybag facilitate the storage of backups in a secure manner.
  • Date: This is the timestamp of a backup created or last updated.
  • ManifestKey: This is the key used to encrypt Manifest.db (wrapped with protection class four).
  • WasPasscodeSet: This identifies whether a passcode was set on the device when it was last synced.
  • Lockdown: This contains device details, the last backup computer's name, and other remote ...

Get Practical Mobile Forensics - Third Edition now with the O’Reilly learning platform.

O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.