I am using Autopsy 4.18 I am trying to process a iTunes backup of a iPhone 6 IOS 13. I can’t get the program to process the backup I converted the backup to a .tar will allow me to add the file but will not process.
What are you trying to accomplish here? Can you provide more context about what you are doing?
@Mark_McKinnon, @Cyberpi777 I am trying to do the same. I have the .tar file, but when I try to get Autopsy to process it, it goes through the process, but returns nothing in the end. I processed the same .tar file with FTK and it returned lots of artifacts, but when I try to analyze the same .tar file with Autopsy, I get nothing.
Is there something that I am not doing correctly to get Autopsy to parse the information. I have checked the iLEAP choice in the ingest module and the extract embedded files.
Any assistance from the community here would be greatly appreciated.
Thanks
So if I understand you correctly you have a file named 13-3-1.tar and you have added it as a logical file. You then want to process this file using the ios (iLeapp) ingest module. Is this file an iTunes backup or a file system in a tar file?
@Mark_McKinnon that is correct, it was added as a logical file, and want to process it in Autopsy. The file is from an iTunes back up.
iLeapp will not be able to process an iTunes backup as it only uses the arguments -f <fs,tar,zip,gz> -i <input file/directory> -o . As you can see the itunes option is not enabled.