I'm trying to do a forensic analysis of an iPhone, saving a backup which is as raw as possible.

Using iMazing, I can backup apps using <Copy to Mac>:

enter image description here

.or <Manage Apps: Extract App>:

enter image description here

Which is the one which gives a backup that is as raw as possible?

Indeed, why would they even produce different IPA files?

(<Extract App> produces a IPA file that contains an extra <Payload> folder, <iTunesArtwork>, and <iTunesMetadata.plist>.)

  • 1
    I'm voting to close this question as off-topic because this question should be posed to iMazing support. – IconDaemon Aug 22 '17 at 12:07
  • 2
    @IconDaemon, I'm seeing this issue with other iPhone backup tools too. Question is: What's the proper way to do a iPhone forensic backup? Saving the first kind of IPA or the second? – Pacerier Aug 22 '17 at 20:33

In iMazing there is multiple ways to browse backups or app data.

Here is the few possibilities:

  1. Browse a specific app's backup content

enter image description here

  1. Browse all backup's files and folders

enter image description here

  1. Use the function "Export Raw Data" (right click the device from the sidebar and click "Export Raw Data")

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .