Here we are looking at the different installations of iTunes and how it controls the timestamps in the three plist files previously discussed. On the left, we are looking at the full install of iTunes on a Mac or a PC. Here, this is a PC example. The path is the key in knowing how the backup was created.  C:\Users\<UserName>\AppData\Roaming\Apple Computer\MobileSync\Backup is the storage location for Apple iTunes and its backups. The timestamps included here are:

  •  Manifest.plist – the last time the encryption status for the backup of that device changed

  •  Info.plist – the date the backup was last completed – NOTE – will be timestamped by forensic tools! Also, the date is always a few seconds after the backup was really completed.

  •  Status.plist – the true time the last successful backup completed.

For the right side, we are looking at the iTunes version of the Microsoft App. The path is C:\Users\<UserName>\Apple\MobileSync\Backup. Here, the only trusted timestamp is the info.plist which is a few seconds after the backup completed. The other timestamps represent the last time the full install version of iTunes was used on a different system. These should not be relied upon. For more information on this, refer to the blog posts by Heather Mahalik on smarterforensics.com and https://www.cellebrite.com/en/blog/.

Apple iTunes.

Microsoft App iTunes