Both Windows and Macs can be used to back up iOS devices. Every computer, external storage, backup drive, etc., should be examined for legacy backup files. As previously stated, backup files may contain information that is no longer stored on the device that could be unique to the investigation. You may find multiple backups for the same device (depending on the iTunes version) or simply a backup that is updated when the user connects their device to sync.
On Windows computers, the following locations may store iOS backup files:
Windows Vista and later: C:\Users\<UserName>\AppData\Roaming\Apple Computer\MobileSync\Backup or C:\Users\<UserName>\Apple\MobileSync\Backup
The location of the backup depends on if the user backed up the device using natively installed iTunes or the Windows app version of the iTunes. The second location is where the Windows (Microsoft) app version of iTunes is stored, while the first is the original location of iOS backups.
Windows XP: C:\Documents and Settings\<User Name>\Application Data\Apple Computer\MobileSync\Backup
On a Mac, the following location stores iOS backup files. (NOTE: If you don't see the Library folder listed, you must access the user folder by following the path Go > Go to Folder > Library, and access is provided.)
Mac OS: MacHD/Users/<UserName>/Library/Application Support/MobileSync/Backup
Searching for iOS backup files is not simple because the filenames do not have a consistent extension. It is best to search for the folders that commonly contain backup files. In the past for older versions of iTunes, a general search could be conducted for *.md*, which should find the common file extensions (.mddata, .mdinfo, and so on). Since file extensions are no longer applied to iTunes backups, it’s best to search for info.plist or manifest.plist, as we know these files exist in all iTunes backups. If the user has not moved the backup files, you could simply search for MobileSync and find the backup directory on both PC and Mac.
The backup files used to be stored in a folder named with a 40-digital alphanumeric GUID.1 Since September 2018-present with the release of Apple Watch Series 4, iPhone XR, iPhone XS, and iPhone XS Max, the UDID format changed. All devices released after these use the new format: 8 characters of ChipID padded with zeros on the left, without leading zeros. e.g., 8020 for iPhone XS/XR Seriex and 8030 for iPhone 11 Series. A hyphen, followed by 16 characters of ECID in hexadecimal padded with zeros on left. The general format will be:[0padding]CHIP-[0padding]ECID2.
As new hardware releases from Apple be ready for backup naming conventions and formats to change.
References:
[1] https://for585.com/itunesbackups
[2] https://for585.com/udid
