{"id":13642407,"url":"https://github.com/jsharkey13/iphone_backup_decrypt","last_synced_at":"2025-04-07T18:11:31.791Z","repository":{"id":53027301,"uuid":"220779330","full_name":"jsharkey13/iphone_backup_decrypt","owner":"jsharkey13","description":"Decrypt an encrypted local iOS backup on Windows or MacOS","archived":false,"fork":false,"pushed_at":"2024-09-18T15:45:49.000Z","size":71,"stargazers_count":290,"open_issues_count":0,"forks_count":55,"subscribers_count":10,"default_branch":"master","last_synced_at":"2025-03-31T17:16:17.406Z","etag":null,"topics":["backup","decryption","forensics","ios","ios-backup","iphone","itunes","python","whatsapp"],"latest_commit_sha":null,"homepage":"","language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"other","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/jsharkey13.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE.txt","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2019-11-10T11:20:24.000Z","updated_at":"2025-03-29T05:16:21.000Z","dependencies_parsed_at":"2024-02-02T22:30:54.037Z","dependency_job_id":"b1bd980e-4d64-4eca-a5f0-57538684ec0c","html_url":"https://github.com/jsharkey13/iphone_backup_decrypt","commit_stats":null,"previous_names":[],"tags_count":13,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jsharkey13%2Fiphone_backup_decrypt","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jsharkey13%2Fiphone_backup_decrypt/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jsharkey13%2Fiphone_backup_decrypt/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jsharkey13%2Fiphone_backup_decrypt/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/jsharkey13","download_url":"https://codeload.github.com/jsharkey13/iphone_backup_decrypt/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":247704571,"owners_count":20982298,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["backup","decryption","forensics","ios","ios-backup","iphone","itunes","python","whatsapp"],"created_at":"2024-08-02T01:01:31.036Z","updated_at":"2025-04-07T18:11:31.741Z","avatar_url":"https://github.com/jsharkey13.png","language":"Python","funding_links":[],"categories":["Python"],"sub_categories":[],"readme":"# iphone-backup-decrypt\n\nDecrypt an encrypted, local iPhone backup created from iOS13 or newer.\nThis code [was based on this StackOverflow answer](https://stackoverflow.com/a/13793043),\nitself based on the [iphone-dataprotection](https://code.google.com/p/iphone-dataprotection/) code.\n\n## Install\n\n[![PyPI - Version](https://img.shields.io/pypi/v/iphone-backup-decrypt)](https://pypi.org/project/iphone-backup-decrypt/)\n\nRequires [Python 3.8](https://www.python.org/) or higher.\n\nThe backup decryption keys are protected using 10 million rounds of PBKDF2 with SHA256, then 10 thousand further iterations of PBKDF2 with SHA-1.\nTo speed up decryption, `fastpbkdf2` is desirable; otherwise the code will fall back to using `pycryptodome`'s implementation.\nThe fallback is ~50% slower at the initial backup decryption step, but does not require the complicated build and install of `fastpbkdf2`.\n\nInstall via `pip`:\n```shell script\npip install iphone_backup_decrypt\n# Optionally:\npip install fastpbkdf2\n```\n\nOr if you have Docker, an alternative is to use the pre-built image: `ghcr.io/jsharkey13/iphone_backup_decrypt`. A Command Prompt example might look like: \n```shell\ndocker run --rm -it ^\n    -v \"%AppData%/Apple Computer/MobileSync/Backup/[device-specific-hash]\":/backup:ro ^\n    -v \"%cd%/output\":/output ^\n    ghcr.io/jsharkey13/iphone_backup_decrypt\n```\n\n## Usage\n\nThis code decrypts the backup using the passphrase chosen when encrypted backups were enabled in iTunes.\n\nThe `relativePath` of the file(s) to be decrypted also needs to be known.\nVery common files, like those for the call history or text message databases, can be found in the `RelativePath` class: e.g. use `RelativePath.CALL_HISTORY` instead of the full `Library/CallHistoryDB/CallHistory.storedata`.\n\nMore complex matching, particularly for non-unique filenames, may require specifying the `domain` of the files. The `DomainLike` and `MatchFiles` classes contain common domains and domain-path pairings. \n\nIf the relative path is not known, you can manually open the `Manifest.db` SQLite database and explore the `Files` table to find those of interest.\nAfter creating the class, use the `EncryptedBackup.save_manifest_file(...)` method to store a decrypted version.\n\nA minimal example to decrypt and extract some files might look like:\n```python\nfrom iphone_backup_decrypt import EncryptedBackup, RelativePath, MatchFiles\n\npassphrase = \"...\"  # Or load passphrase more securely from stdin, or a file, etc.\nbackup_path = \"%AppData%/Apple Computer/MobileSync/Backup/[device-specific-hash]\"\n# Or MacOS: \"/Users/[user]/Library/Application Support/MobileSync/Backup/[device-hash]\"\n\nbackup = EncryptedBackup(backup_directory=backup_path, passphrase=passphrase)\n\n# Extract the call history SQLite database:\nbackup.extract_file(relative_path=RelativePath.CALL_HISTORY, \n                    output_filename=\"./output/call_history.sqlite\")\n\n# Extract the camera roll, using MatchFiles for combined path and domain matching:\nbackup.extract_files(**MatchFiles.CAMERA_ROLL, output_folder=\"./output/camera_roll\")\n\n# Extract any iCloud camera roll images on the device (may include thumbnails for some\n# but not all images offloaded to the cloud, and have duplicates from the camera roll):\nbackup.extract_files(**MatchFiles.ICLOUD_PHOTOS, output_folder=\"./output/icloud_photos\")\n\n# Extract WhatsApp SQLite database and attachments:\nbackup.extract_file(relative_path=RelativePath.WHATSAPP_MESSAGES,\n                    output_filename=\"./output/whatsapp.sqlite\")\nbackup.extract_files(**MatchFiles.WHATSAPP_ATTACHMENTS,\n                     output_folder=\"./output/whatsapp\", preserve_folders=False)\n\n# Extract Strava workouts:\nbackup.extract_files(**MatchFiles.STRAVA_WORKOUTS, output_folder=\"./output/strava\")\n```\n\n## Alternatives\n\nThis library aims to be minimal, providing only what is necessary to extract encrypted files. There are alternatives which claim to offer similar or more advanced functionality:\n\n - [KnugiHK/iphone_backup_decrypt](https://github.com/KnugiHK/iphone_backup_decrypt/tree/master), a fork of this library and part of [Whatsapp-Chat-Exporter](https://github.com/KnugiHK/Whatsapp-Chat-Exporter).\n - [jfarley248/iTunes_Backup_Reader](https://github.com/jfarley248/iTunes_Backup_Reader), which uses an older version of this library.\n - [datatags/mount-ios-backup](https://github.com/datatags/mount-ios-backup), which uses an older version of this library.\n - [PeterUpfold/dump-iphone-backup](https://github.com/PeterUpfold/dump-iphone-backup), a wrapper for this library to decrypt a whole backup on the command-line.\n - [avibrazil/iOSbackup](https://github.com/avibrazil/iOSbackup) a similar Python library with a friendlier interface for exploring a backup.\n - [MaxiHuHe04/iTunes-Backup-Explorer](https://github.com/MaxiHuHe04/iTunes-Backup-Explorer), a Java based alternative with a GUI.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fjsharkey13%2Fiphone_backup_decrypt","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fjsharkey13%2Fiphone_backup_decrypt","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fjsharkey13%2Fiphone_backup_decrypt/lists"}