Before we start examining the primary plists contained in iOS backups, we have to consider how the backup was created. For this portion of the course, we are focusing on user-created iOS backups. This means the user launched iTunes and backed up their data to a PC or Mac. However, the type of iTunes used matters here. By type, I mean was iTunes natively installed from the Apple store or a legitimate installer or was the user pushed to the Microsoft store to install iTunes as an app? Most people wouldn’t even know, but it matters. Where the data is stored will be different and some timestamps become untrustworthy. If you aren’t sure what you have installed, create a backup, and follow the path.

As we previously discussed, the Microsoft app of iTunes will store the data in C:\Users\<User>\Apple\MobileSync\Backup and Apple iTunes (native install) will store the data as discussed previously in the ~\AppData\Roaming\Apple Computer\MobileSync\Backup directory. The reason this is so important here is the date modified of the backup that was created by the Microsoft app. I installed the native iTunes app and the date of the backup shown in the bottom graphic had a new modified time because iTunes must interact with that directory. DO NOT trust these dates as they have zero correlation as to when the backup was created. You need more concrete evidence, and we are going to investigate that now.