01Location
- macOS: ~/Library/Application Support/MobileSync/Backup/<device-id>/Manifest.db
- Windows: starts under %AppData% (iTunes) or %USERPROFILE% (Apple Devices app / Microsoft Store iTunes); see Apple's article for the full folder
- <backup>/<first two hex chars of fileID>/<fileID>
02Questions it answers
- Which on-device files are present in a computer backup?
- Where does a backed-up file map on the device file system?
- What creation and modification times were recorded for a file?
03Format and versions
| Format | SQLite. Files(fileID, domain, relativePath, flags, file): fileID names the stored copy, kept in a sub-folder named after its first two characters; file is a binary plist with metadata such as Birth, LastModified, Size and, in encrypted backups, an EncryptionKey entry. iLEAPP treats flags = 1 as files. Older backups used Manifest.mbdb instead. |
|---|---|
| Applies to | iLEAPP labels Manifest.db the iOS 10+ backup format and Manifest.mbdb the older one. In the older format, file names are SHA-1 hashes of domain and path joined by a dash (e.g. HomeDomain-Library/SMS/sms.db). |
04Key fields
| Field | What it tells you |
|---|---|
| fileID | Hash-derived identifier and on-disk name of the stored copy. |
| domain | Backup domain, e.g. HomeDomain, CameraRollDomain, WirelessDomain, AppDomain-<bundle>; iLEAPP maps domains to device paths (HomeDomain → /private/var/mobile). |
| relativePath | Path relative to the domain root. |
| flags | Entry kind; iLEAPP selects flags = 1 for files. |
| file (bplist) | Per-file metadata: Birth, LastModified, Size, protection/encryption details. |
05Timestamps
| Field | Encoding | Note |
|---|---|---|
| file plist: Birth / LastModified | Integer; epoch not stated in the cited sources | Read by iLEAPP as the file's creation and modification times; they describe the device file, not the backup run. Verify the epoch before converting. |
Decode raw values with the Timestamp decoder and convert local wall-clock times with the Local time to UTC.
06Examination workflow
- Check Manifest.plist for IsEncrypted before attempting to read file content.
- Query Files and rebuild device paths from domain + relativePath.
- Locate each copy at <first two chars>/<fileID> and verify hashes.
- Decode the file plist for times and sizes.
07Interpretation pitfalls
- A backup holds only what the backup service includes; Edwards did not find knowledgeC.db in iTunes-style backups.
- In encrypted backups, metadata and content are protected; the index alone cannot reveal content.
09Sources
- iLEAPP — scripts/search_files.py Alexis Brignoni et al. (GitHub) · checked 2026-10-14
- iTunes Backup The Apple Wiki · checked 2026-10-14
- Locate and manage backups of your iPhone, iPad, and iPod touch Apple Support · checked 2026-10-14
- Knowledge is Power! Using the macOS/iOS knowledgeC.db Database to Determine Precise User and Application Usage Sarah Edwards, mac4n6.com (2018) · checked 2026-10-14