GASF practice question 4 of 15
Which iOS backup file will contain the last time the device was backed up?
Full set: 75 questionsThe Info.plist file, located in the root directory of an unencrypted iOS backup, is a property list file containing key metadata about the backup and the device itself. This file stores numerous key-value pairs, including the device's name, UDID, serial number, iOS version, and, most relevantly, the Last Backup Date. This timestamp explicitly records the date and time the backup process was initiated, making it the direct source for the information requested in the question.
A. notes.sqlite: This is an application-specific SQLite database file that stores the content of the user's notes, not metadata about the backup process.
B. manifest.mbdb: This file is a database that maps the original file paths on the iOS device to the hashed filenames used within the backup folder.
C. status.plist: This file contains information about the completion state of the backup (e.g., if it was successful), but the Info.plist holds the primary, canonical metadata.
1. Zdziarski, J. (2014). Hacking and Securing iOS Applications. O'Reilly Media. In Chapter 2, "iOS Security," the structure of iTunes backups is detailed, identifying Info.plist as the file containing device identifiers and the Last Backup Date.
2. Baggili, I., Behzadan, B., & Al-Sallami, Z. (2018). A Tale of Three Backups: A Comparative Study of the Forensic Artifacts Generated by Mobile Device Backup Software. Proceedings of the 13th International Conference on Availability, Reliability and Security (ARES 2018). Association for Computing Machinery, New York, NY, USA, Article 53, 1–10. Section 3.1, "iTunes Backup," describes the key files, stating, "The Info.plist file contains metadata about the backup, such as the device’s unique identifier (UDID), name, and the date of the last backup." DOI: https://doi.org/10.1145/3230833.3233277
3. National Institute of Standards and Technology (NIST). (2014). Guidelines on Mobile Device Forensics (NIST Special Publication 800-101 Revision 1). Appendix F, "Apple iOS," discusses the file system and backup structure, identifying the Info.plist file as a primary source of metadata for an iTunes backup.
Keep practicing
Take the free GASF practice test
Ten exam-style questions with answers and explanations, plus the exam facts and study guides.
More questions
Other GASF practice questions
- Question 3Which of the following can most forensics tools crack on an iOS device?
- Question 5As part of your analysis of a legacy BlackBerry device, you examine the installed applica…
- Question 6Which file system is mostly found on Samsung devices?
- Question 7What does access to iOS DFU mode provide an examiner?
- Question 8When examining a file system acquisition of an Android device Which artifact must be carv…
- Question 10Which cloud based system can be utilized by Android owners to backup user data?
