Extracting Contacts from an iOS backup

  • This is tricky since the format is not well-documented and there are a bunch of files with just random hexadecimal strings as names.
  • On Mac, the backups are stored at ~/Library/Application Support/MobileSync/Backup. For some reason the contents of this directory aren't visible from the terminal, but are in Finder. If you copy the backup into another directory then you can use the backup in Terminal as well.
  • Extracting Contacts

    • The address book file is in the backup at 31/31bb7ba8914766d4ba40d6dfb6113c8b614be442. This is a SQLite3 database.
    • The main tables you care about here are ABPerson and ABMultiValue. To do a simple extraction of names and phone/email you can use a query like this.
      • select ABPerson.last, ABPerson.first, ABMultiValue.value
        from ABPerson,ABMultiValue
        where ABMultiValue.record_id=ABPerson.ROWID order by Last, First
  • Locating Files

    • The Manifest.db is a database of all the files. You can run a query like this to find a file.
      • SELECT fileID, relativePath
        FROM Files
        WHERE relativePath like '%Address%';
    • From there, the first two digits of the fileId indicate the directory to look into, and the entire fieId is then the filename in that directory.
    • The pypi page for the iOSbackup Python package also has a list of commonly needed files and their fileID values.

Thanks for reading! If you have any questions or comments, please send me a note on Twitter.