GASF practice question 4 of 15

Which iOS backup file will contain the last time the device was backed up?

Full set: 75 questions
Answer options
A: notes.sqlite
B: manifest.mbdb
C: status.plist
D: info.plist Correct answer
Correct Answer:
D. info.plist
Explanation

The Info.plist file, located in the root directory of an unencrypted iOS backup, is a property list file containing key metadata about the backup and the device itself. This file stores numerous key-value pairs, including the device's name, UDID, serial number, iOS version, and, most relevantly, the Last Backup Date. This timestamp explicitly records the date and time the backup process was initiated, making it the direct source for the information requested in the question.

Why Incorrect

A. notes.sqlite: This is an application-specific SQLite database file that stores the content of the user's notes, not metadata about the backup process.
B. manifest.mbdb: This file is a database that maps the original file paths on the iOS device to the hashed filenames used within the backup folder.
C. status.plist: This file contains information about the completion state of the backup (e.g., if it was successful), but the Info.plist holds the primary, canonical metadata.

References

1. Zdziarski, J. (2014). Hacking and Securing iOS Applications. O'Reilly Media. In Chapter 2, "iOS Security," the structure of iTunes backups is detailed, identifying Info.plist as the file containing device identifiers and the Last Backup Date.

2. Baggili, I., Behzadan, B., & Al-Sallami, Z. (2018). A Tale of Three Backups: A Comparative Study of the Forensic Artifacts Generated by Mobile Device Backup Software. Proceedings of the 13th International Conference on Availability, Reliability and Security (ARES 2018). Association for Computing Machinery, New York, NY, USA, Article 53, 1–10. Section 3.1, "iTunes Backup," describes the key files, stating, "The Info.plist file contains metadata about the backup, such as the device’s unique identifier (UDID), name, and the date of the last backup." DOI: https://doi.org/10.1145/3230833.3233277

3. National Institute of Standards and Technology (NIST). (2014). Guidelines on Mobile Device Forensics (NIST Special Publication 800-101 Revision 1). Appendix F, "Apple iOS," discusses the file system and backup structure, identifying the Info.plist file as a primary source of metadata for an iTunes backup.

Scroll to Top