Extracting Contacts from an iOS backup

Written 2023-09-21

This is tricky since the format is not well-documented and there are a bunch of files with just random hexadecimal strings as names.
On Mac, the backups are stored at ~/Library/Application Support/MobileSync/Backup. For some reason the contents of this directory aren't visible from the terminal, but are in Finder. If you copy the backup into another directory then you can use the backup in Terminal as well.
Extracting Contacts
- The address book file is in the backup at 31/31bb7ba8914766d4ba40d6dfb6113c8b614be442. This is a SQLite3 database.
- The main tables you care about here are ABPerson and ABMultiValue. To do a simple extraction of names and phone/email you can use a query like this.
  - ```
  select ABPerson.last, ABPerson.first, ABMultiValue.value
  from ABPerson,ABMultiValue
  where ABMultiValue.record_id=ABPerson.ROWID order by Last, First
```
Locating Files
- The Manifest.db is a database of all the files. You can run a query like this to find a file.
  - ```
  SELECT fileID, relativePath
  FROM Files
  WHERE relativePath like '%Address%';
```
- From there, the first two digits of the fileId indicate the directory to look into, and the entire fieId is then the filename in that directory.
- The pypi page for the iOSbackup Python package also has a list of commonly needed files and their fileID values.

Extracting Contacts