01Location
- <backup>/Info.plist
- <backup>/Manifest.plist
- <backup>/Status.plist
- Device: /private/var/mobile/Library/Preferences/com.apple.mobile.ldbackup.plist
02Questions it answers
- Which device (model, serial, IMEI, iOS build) does the backup belong to?
- When was the backup made, and was it encrypted or full?
- Which apps were installed when the backup was taken?
- When did the device last back up to a computer or to iCloud?
03Format and versions
| Format | Property lists. Info.plist: Build Version, Device Name, GUID, ICCID, IMEI, Last Backup Date, Product Type, Product Version, Serial Number and app lists. Manifest.plist: Applications, BackupKeyBag, Date, IsEncrypted, Lockdown, Version, WasPasscodeSet. Status.plist: BackupState, Date, IsFullBackup, SnapshotState, UUID, Version. |
|---|---|
| Applies to | Key lists follow The Apple Wiki and iLEAPP; iLEAPP also reads an Installed Applications array and per-app download information from Info.plist where present. |
04Key fields
| Field | What it tells you |
|---|---|
| Info.plist: Product Version / Build Version / Serial Number / IMEI | Device and OS identification at backup time. |
| Info.plist: Last Backup Date | Date of the backup. |
| Manifest.plist: IsEncrypted / WasPasscodeSet | Whether the backup is encrypted and a passcode was set. |
| Manifest.plist: Lockdown | BuildVersion, DeviceName, ProductType, ProductVersion, SerialNumber, UniqueDeviceID. |
| Status.plist: IsFullBackup / BackupState | Whether it was a full backup and its state. |
| ldbackup.plist: LastiTunesBackupDate / LastCloudBackupDate / CloudBackupEnabled | On-device record of the last computer and iCloud backups. |
05Timestamps
| Field | Encoding | Note |
|---|---|---|
| Last Backup Date / Date | plist date | Backup times as recorded in the backup itself. |
| LastiTunesBackupDate / LastCloudBackupDate | Apple Cocoa time (seconds since 2001-01-01 UTC) | Converted by iLEAPP from Cocoa seconds; companion TZ keys record the zone. |
Decode raw values with the Timestamp decoder and convert local wall-clock times with the Local time to UTC.
06Examination workflow
- Read Manifest.plist first to determine encryption.
- Record identifiers from Info.plist and Lockdown and compare them.
- Check Status.plist for a complete, full backup.
- On a device image, compare ldbackup.plist dates with available backups.
07Interpretation pitfalls
- Info.plist describes the device at backup time; later changes are not reflected.
- The relation of per-app storeCohort dates to install time is not documented.
09Sources
- iTunes Backup The Apple Wiki · checked 2026-10-14
- iLEAPP — scripts/artifacts/iTunesBackupInfo.py Alexis Brignoni et al. (GitHub) · checked 2026-10-14
- iLEAPP — scripts/artifacts/backupSettings.py Alexis Brignoni et al. (GitHub) · checked 2026-10-14
- iLEAPP — scripts/search_files.py Alexis Brignoni et al. (GitHub) · checked 2026-10-14
- CFAbsoluteTime Apple Developer Documentation · checked 2026-10-14