Using Autopsy for iTunes/iOS backup parsing. Is there anything on the horizon for the parsing of an iOS tar file.
Do you mean to parse the backup file and map the hash named files to real paths? Or do you mean to parse more iOS files (Such as plists, app databases, etc.)?
We have an outdated iOS module that has never been released. We don’t have code for the backup file parsing.
I was looking to parse out a iOS backup made by iTunes and see the files and folders in autopsy
Are you looking for something like the following?
iTunes Backup directory on a Windows machine
iTunes backup added into Autopsy as a datasource, from an image, so you can look at the directory structure and see the actual files named properly and in there proper directory that can then be searched, extracted, etc… like a normal image in Autopsy.