Package: iphone-backup-decrypt
iphone-backup-decryptDecrypt an encrypted, local (i.e. non-iCloud), iPhone backup created from iOS13 or newer.
This code is mainly awrapper for this StackOverflow answer,
itself based on theiphone-dataprotectioncode.InstallRequiresPython 3.8or higher.The backup decryption keys are protected using 10 million rounds of PBKDF2 with SHA256, then 10 thousand further iterations of PBKDF2 with SHA-1.
To speed up decryption,fastpbkdf2is desirable; otherwise the code will fall back to usingpycryptodome's implementation.
The fallback is ~50% slower at the initial backup decryption step, but does not require the complicated build and install offastpbkdf2.Install viapip:pipinstalliphone_backup_decrypt# Optionally:pipinstallfastpbkdf2Or if you have Docker, an alternative is to use the pre-built image:ghcr.io/jsharkey13/iphone_backup_decrypt. A Command Prompt example might look like:dockerrun--rm-it^-v"%AppData%/Apple Computer/MobileSync/Backup/[device-specific-hash]":/backup:ro^-v"%cd%/output":/output^ghcr.io/jsharkey13/iphone_backup_decryptUsageThis code decrypts the backup using the passphrase chosen when encrypted backups were enabled in iTunes.TherelativePathof the file(s) to be decrypted also needs to be known.
Very common files, like those for the call history or text message databases, can be found in theRelativePathclass: e.g. useRelativePath.CALL_HISTORYinstead of the fullLibrary/CallHistoryDB/CallHistory.storedata.More complex matching, particularly for non-unique filenames, may require specifying thedomainof the files. TheDomainLikeandMatchFilesclasses contain common domains and domain-path pairings.If the relative path is not known, you can manually open theManifest.dbSQLite database and explore theFilestable to find those of interest.
After creating the class, use theEncryptedBackup.save_manifest_file(...)method to store a decrypted version.A minimal example to decrypt and extract some files might look like:fromiphone_backup_decryptimportEncryptedBackup,RelativePath,MatchFilespassphrase="..."# Or load passphrase more securely from stdin, or a file, etc.backup_path="%AppData%\\Apple Computer\\MobileSync\\Backup\\[device-specific-hash]"backup=EncryptedBackup(backup_directory=backup_path,passphrase=passphrase)# Extract the call history SQLite database:backup.extract_file(relative_path=RelativePath.CALL_HISTORY,output_filename="./output/call_history.sqlite")# Extract the camera roll, using MatchFiles for combined path and domain matching:backup.extract_files(**MatchFiles.CAMERA_ROLL,output_folder="./output/camera_roll")# Extract WhatsApp SQLite database and attachments:backup.extract_file(relative_path=RelativePath.WHATSAPP_MESSAGES,output_filename="./output/whatsapp.sqlite")backup.extract_files(**MatchFiles.WHATSAPP_ATTACHMENTS,output_folder="./output/whatsapp",preserve_folders=False)# Extract Strava workouts:backup.extract_files(**MatchFiles.STRAVA_WORKOUTS,output_folder="./output/strava")AlternativesThis library aims to be minimal, providing only what is necessary to extract encrypted files. There are alternatives which claim to offer similar or more advanced functionality:KnugiHK/iphone_backup_decrypt, a fork of this library and part ofWhatsapp-Chat-Exporter.jfarley248/iTunes_Backup_Reader, which uses an older version of this library.datatags/mount-ios-backup, which uses an older version of this library.avibrazil/iOSbackupa similar Python library with a friendlier interface for exploring a backup.MaxiHuHe04/iTunes-Backup-Explorer, a Java based alternative with a GUI.