7

I backed up my data from my iPhone to my PC. This backup is not encrypted. When I open up the backup folder, I see a bunch of files named with long GUIDs. Each app that saves data (e.g. to a SQLite table will have a file here.

How can I find out which GUID represents a specific app I am looking for?

I used to be able to use findstr "app name" *.mdinfo and then find the corresponding *.mddata file, but as of iTunes 10, there are no *.mdinfo files. This makes it so you can't find the app's name in the files in plain text. So when I try to use findstr "app name" *.*, it doesn't find it either. The files have no extension, and if they are SQLite files, they are in binary format and after examining them, they have no information related to the app's name in them.

Improve this question

2 Answers 2

Reset to default
3

This used to be possible with Erica Sadun's mdhelper program. Unfortunately, it looks like something has changed in the way Apple stores backup files w/ iOS 4.2, and the program cannot achieve the same results (since it finds no mdbackup or mdinfo files).

On the bright side, a new tool named iPhone / iPod Touch Backup Extractor has emerged. It correctly translates the GUIDs to names in my iOS 4.2 backups, and allows the files for each app to be extracted together.

Improve this answer
0

The whole iPhoneTracker kerfuffle has rasied some good information on python scripts and other code examples that can parse the most recent mbdb files.

See http://petewarden.github.com/iPhoneTracker/#2 and https://stackoverflow.com/questions/3085153/how-to-parse-the-manifest-mbdb-file-in-an-ios-4-0-itunes-backup

The stack overflow question has the goods on many tools and several good explanations of the technical details. I also have good things to say about the book iOS Forensic Analysis by Sean Morissey

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .