iOS backup parsing with Belkasoft Evidence Center

The Belkasoft Evidence Center program has already been described in Chapter 6, SQLite Forensics. In this recipe, we will describe how to analyze an iTunes backup via Belkasoft Evidence Center.

How to do it…

1. Start the Belkasoft Evidence Center program. Click the New Case button. Specify the information about the new case, such as the name of the case, the path, where the data of the case will be located, the name of the investigator, a description of the case, and the time zone. Click on the Create and open button:

The window of a new case setting

2. In the next window, specify the path to the iTunes backup that was extracted earlier. Select the Manifest.plist file. Click the Open button and then the Next button:

Selection window of data source

3. Specify the types of data (chats, email messages images, videos, calls, SMS messages, and so on) that you need to extract. Click the Finish button. The more types of data specified for extraction, the longer...