All posts filed under: iOS Artifacts

#9 – Manifest.db BLOBs

comment 1
Digital Forensics / iOS Artifacts / Smartphone Forensics

Yesterday I mentioned extracting BLOB data from Manifest.db, which would be a painful process to do manually. Thankfully, Adrian Leong (@Cheeky4n6Monkey) wrote a python script to automate BLOB extractions from SQLite databases. It is a fairly simple script and will work on any SQLite databases, not just the Manifest.db. An example of the script is below: python sqlite-blob-dumper.py targetdb.sqlite tablename outputdir Test it out. Let him know what you think or submit a pull request […]

#8 – iTunes Backup Manifest.db

comment 1
Digital Forensics / iOS Artifacts / Smartphone Forensics

The Manifest.db is a SQLite database storing information about the iTunes backup. When opened with DB Browser for SQLite, switch to the Browse Data tab to preview the contents of the tables. In the above photo, you can see the table’s contents on the left side. When you see BLOB as the content, you will likely want to export the data to view in another application. To see the content in SQLite, on the right […]