Smartphone backup files are an important part of any investigation. Users can wipe and delete data from their smartphones, but that doesn't delete or omit data that resides on a backup file on external media, the host computer, or in iCloud.

Backup files may contain data that the user believes no longer exists. When a user deletes data from his/her device, that information may exist temporarily in the backup file and may be recovered during a forensic examination. Depending on the smartphone, backup method, and storage space, multiple backup files may reside for a single device. Thus, as the data on the devices continue to change, each backup may contain unique data. Some iOS devices overwrite old backup files during the backup process, while other versions will create a new backup or snapshot with a date. Additionally, it is common for backups to exist both in iCloud and on the user’s host computers. For example, I have backups in iCloud, on my Mac and on my PC. Chances are good that none of these backups are the same and some will contain data that will be missing from another.

Creating a backup file of a smartphone may be the only acquisition method, depending on the device.¹ This concept is discussed in the upcoming slides. Make sure the backup created for forensic examination is always set to encrypt the backup with a passcode that you remember and document in your case notes.

Reference:

[1] https://for585.com/backup (Describes the method for creating backup files of multiple smartphones. This may be useful to your investigation should backup file creation be the only method for pulling data from a device).