# ITunes Backup Process

**URL:** https://sleuthkit.discourse.group/t/itunes-backup-process/2727
**Category:** Autopsy Help
**Created:** [July 19, 2021, 1:37pm UTC](https://sleuthkit.discourse.group/t/itunes-backup-process/2727 "2021-07-19T13:37:43Z")
**Posts on this page:** 10
**Page:** 1

<div class="post-metadata">

### Author: ![Cyberpi777](https://yyz2.discourse-cdn.com/free1/user_avatar/sleuthkit.discourse.group/cyberpi777/32/1419_2.png) [@Cyberpi777](https://sleuthkit.discourse.group/u/Cyberpi777)
#### Post date: [July 19, 2021, 1:37pm UTC](https://sleuthkit.discourse.group/t/itunes-backup-process/2727/1 "2021-07-19T13:37:43Z")

</div>

I am using Autopsy 4.18 I am trying to process a iTunes backup of a iPhone 6 IOS 13. I can’t get the program to process the backup I converted the backup to a .tar will allow me to add the file but will not process.

---

<div class="post-metadata">

### Author: ![Mark\_McKinnon](https://yyz2.discourse-cdn.com/free1/user_avatar/sleuthkit.discourse.group/mark_mckinnon/32/42_2.png) [@Mark\_McKinnon](https://sleuthkit.discourse.group/u/Mark_McKinnon)
#### Post date: [August 17, 2021, 2:55pm UTC](https://sleuthkit.discourse.group/t/itunes-backup-process/2727/2 "2021-08-17T14:55:35Z")

</div>

What are you trying to accomplish here? Can you provide more context about what you are doing?

---

<div class="post-metadata">

### Author: ![AccessInv](https://avatars.discourse-cdn.com/v4/letter/a/8c91f0/32.png) [@AccessInv](https://sleuthkit.discourse.group/u/AccessInv)
#### Post date: [January 5, 2022, 11:14pm UTC](https://sleuthkit.discourse.group/t/itunes-backup-process/2727/3 "2022-01-05T23:14:18Z")

</div>

@Mark_McKinnon, @Cyberpi777 I am trying to do the same. I have the .tar file, but when I try to get Autopsy to process it, it goes through the process, but returns nothing in the end. I processed the same .tar file with FTK and it returned lots of artifacts, but when I try to analyze the same .tar file with Autopsy, I get nothing.  
Is there something that I am not doing correctly to get Autopsy to parse the information. I have checked the iLEAP choice in the ingest module and the extract embedded files.

Any assistance from the community here would be greatly appreciated.  
Thanks

 ![ADFTK Capture](https://global.discourse-cdn.com/free1/uploads/sleuthkit/original/2X/9/9ec83e461a6794a274d4b11dbe99f3309a9870e4.png)

---

<div class="post-metadata">

### Author: ![AccessInv](https://avatars.discourse-cdn.com/v4/letter/a/8c91f0/32.png) [@AccessInv](https://sleuthkit.discourse.group/u/AccessInv)
#### Post date: [January 5, 2022, 11:15pm UTC](https://sleuthkit.discourse.group/t/itunes-backup-process/2727/4 "2022-01-05T23:15:01Z")

</div>

![Autopsy Capture](https://global.discourse-cdn.com/free1/uploads/sleuthkit/original/2X/e/e67a3d062aaf5a657772c2ab2cd870d8d47ec9db.png)

---

<div class="post-metadata">

### Author: ![Mark\_McKinnon](https://yyz2.discourse-cdn.com/free1/user_avatar/sleuthkit.discourse.group/mark_mckinnon/32/42_2.png) [@Mark\_McKinnon](https://sleuthkit.discourse.group/u/Mark_McKinnon)
#### Post date: [January 6, 2022, 12:18am UTC](https://sleuthkit.discourse.group/t/itunes-backup-process/2727/5 "2022-01-06T00:18:51Z")

</div>

So if I understand you correctly you have a file named 13-3-1.tar and you have added it as a logical file. You then want to process this file using the ios (iLeapp) ingest module. Is this file an iTunes backup or a file system in a tar file?

---

<div class="post-metadata">

### Author: ![AccessInv](https://avatars.discourse-cdn.com/v4/letter/a/8c91f0/32.png) [@AccessInv](https://sleuthkit.discourse.group/u/AccessInv)
#### Post date: [January 6, 2022, 7:15pm UTC](https://sleuthkit.discourse.group/t/itunes-backup-process/2727/6 "2022-01-06T19:15:24Z")

</div>

@Mark_McKinnon that is correct, it was added as a logical file, and want to process it in Autopsy. The file is from an iTunes back up.

---

<div class="post-metadata">

### Author: ![Mark\_McKinnon](https://yyz2.discourse-cdn.com/free1/user_avatar/sleuthkit.discourse.group/mark_mckinnon/32/42_2.png) [@Mark\_McKinnon](https://sleuthkit.discourse.group/u/Mark_McKinnon)
#### Post date: [January 6, 2022, 7:37pm UTC](https://sleuthkit.discourse.group/t/itunes-backup-process/2727/7 "2022-01-06T19:37:22Z")

</div>

iLeapp will not be able to process an iTunes backup as it only uses the arguments -f \<fs,tar,zip,gz\> -i \<input file/directory\> -o . As you can see the itunes option is not enabled.

---

<div class="post-metadata">

### Author: ![rrostas](https://avatars.discourse-cdn.com/v4/letter/r/da6949/32.png) [@rrostas](https://sleuthkit.discourse.group/u/rrostas)
#### Post date: [July 15, 2025, 3:41pm UTC](https://sleuthkit.discourse.group/t/itunes-backup-process/2727/9 "2025-07-15T15:41:05Z")

</div>

Was there a solution to this? Seems I’m having the same issue.

---

<div class="post-metadata">

### Author: ![Mark\_McKinnon](https://yyz2.discourse-cdn.com/free1/user_avatar/sleuthkit.discourse.group/mark_mckinnon/32/42_2.png) [@Mark\_McKinnon](https://sleuthkit.discourse.group/u/Mark_McKinnon)
#### Post date: [July 16, 2025, 1:44am UTC](https://sleuthkit.discourse.group/t/itunes-backup-process/2727/10 "2025-07-16T01:44:11Z")

</div>

Not yet, but I am working on it. If you want to test it for me when I get it working let me know.

---

<div class="post-metadata">

### Author: ![rrostas](https://avatars.discourse-cdn.com/v4/letter/r/da6949/32.png) [@rrostas](https://sleuthkit.discourse.group/u/rrostas)
#### Post date: [July 16, 2025, 3:54pm UTC](https://sleuthkit.discourse.group/t/itunes-backup-process/2727/11 "2025-07-16T15:54:58Z")

</div>

Would be glad too. Let me know.
