Reading an iPhone backup
A local backup is a complete copy of the phone sitting in a folder on your computer. It is the easiest way to get at your messages, and it needs nothing installed — but the folder is deliberately unreadable by hand, which is where most people stop.
Where the backup already is
If you have ever backed the phone up to this computer rather than to iCloud, it is here:
| System | Location |
|---|---|
| macOS | ~/Library/Application Support/MobileSync/Backup/ |
| Windows | %APPDATA%\Apple\MobileSync\Backup\ |
Inside are one or more folders with long hexadecimal names — one per device. If there are
several, the newest modification date is usually the one you want, and
Info.plist inside each names the device it came from.
No backup yet? Connect the phone, open Finder, select the device in the sidebar, choose Back up all of the data on your iPhone to this Mac, and click Back Up Now. On Windows, the same controls are in the Apple Devices app or iTunes.
What is in the folder
| File | What it is |
|---|---|
Manifest.db | A SQLite index of every file in the backup: its domain, its path on the phone, and the name it was stored under here. |
Manifest.plist | Backup-wide settings, including whether it is encrypted and, if so, the wrapped keys. |
Info.plist | The device: name, model, iOS version, phone number, last backup date. |
Status.plist | Whether the backup finished. A backup that was interrupted says so here. |
00 … ff | 256 folders holding the actual files, named by hash rather than by anything readable. |
Why nothing in it has a filename
Every file is stored under the SHA-1 of its domain and path joined by a hyphen, in a folder named after the first two characters of that hash. Messages always lands in the same place, because the input is always the same string:
SHA1("HomeDomain-Library/SMS/sms.db")
= 3d0d7e5fb2ce288813306e4d4636395e047a3d28
stored at: 3d/3d0d7e5fb2ce288813306e4d4636395e047a3d28
That file is an ordinary SQLite database — the phone's equivalent of the Mac's
chat.db. CertifiedCopy computes that hash in the browser and opens the file
directly, which is why you hand it the folder rather than hunting for one file among tens of
thousands.
Encrypted backups
If Encrypt local backup was ticked, every file in the folder is encrypted and the hashed names give nothing away. It is worth ticking: an encrypted backup includes saved passwords, Health data and call history, which an unencrypted one leaves out.
Opening one needs the backup password — set when the backup was first encrypted. It is not your
Apple ID password and not the phone's passcode, and Apple cannot recover it. Given the password,
the chain is: derive a key from it, unwrap the keybag in
Manifest.plist, unwrap each file's own key from its record, decrypt the file.
CertifiedCopy does all of that in the page. The password is used in your browser and there is
nowhere for it to be sent.
What is not in a backup
- Anything kept in iCloud instead. With Messages in iCloud switched on, the conversations live in iCloud and a local backup may contain little or none of them. This is the single most common reason a backup opens and the messages are not there.
- Deleted messages. Recently Deleted holds them for about 30 days; after that they are gone from the database too.
- Apple Pay data, Face ID and Touch ID settings, which never leave the device.
- Anything added since. A backup is a snapshot. Messages sent after it was taken are not in it.
Reading it without installing anything
- Open the app.
- Choose an iPhone backup folder and select the device folder itself.
- If it is encrypted, enter the backup password when asked.
- Browse the conversations, then export a thread or a date range to PDF or CSV.
The folder is read in your browser. Nothing is uploaded, and there is no server to upload to — open the network panel and watch while you do it.