Introducing iTunes backups

Investigating a device that is locked by an unknown passcode can quickly bring an investigation to a halt if the iPhone in question is one of the newer models, such as the iPhone 13 or the iPhone 12; however, if the suspect has backed up their device to their desktop or laptop and the investigator has access to this machine, the backup can easily be recovered, extracted, and analyzed.

Another reason why examining backups may be beneficial is that the user may have deleted some data from their mobile device, but that doesn't delete the data that resides within the backup: it's quite common, in fact, that backup files contain data that the user believes no longer exists.

Local backups, also called iTunes backups, are essentially a logical acquisition of the device and typically contain contacts, SMS messages, media files, logs, databases, keychains, preferences, configurations, browsing artifacts, and location data, for example. A backup can...