Practical Mobile Forensics - Third Edition

Encrypted backup

For encrypted backups, the backup files are encrypted using the AES256 algorithm in the CBC mode, with a unique key and a null initialization vector (IV). The unique file keys are protected with a set of class keys from the Backup keybag. The class keys in the Backup keybag are protected with a key derived from the password set in iTunes through 10,000 iterations of Password-Based Key Derivation Function 2 (PBKDF2). Both open source and commercial tools provide support for encrypted backup file parsing if the password is known. Some tools won't even prompt for a password, which makes them useless in a forensic investigation. Other tools will attempt to crack the password.