Working with Non-encrypted Backup

<< Click to Display Table of Contents >>

Navigation:  Elcomsoft Phone Breaker > Working with Apple devices > Working with iTunes backup >

Working with Non-encrypted Backup

When you work with iTunes backups, the encrypted backups need to be decrypted in order to work with them. However, non-encrypted backups can be difficult to work with as well, because all file names are displayed as an SHA-1 hash of file name, together with its path and domain.


EPB allows you to restore original file names of non-encrypted backups so that file names in backup are displayed as in macOS. You can explore the backup content with either restored or not restored file names in Elcomsoft Phone Viewer.

To restore original file names of a non-encrypted backup, do the following:

1. In the Tools menu, select the Apple tab.

2.Select Decrypt backup.

3.Select the Manifest.plist file either by drag-and-dropping it to the Decrypt backup window, or click Choose backup.

NOTE: On macOS 10.14 and higher, you need to grant the Full Disk Access permission to EPB to have access to the default iTunes backups folder. For details, see Troubleshooting.

4.In the opened window navigate to the backup file by entering the file path in the path box. Select the Manifest.plist file and click Choose.

The properties of the selected file are displayed below the grid.

custom window

5. When the backup is loaded, you can view the following information about backup:

Serial number

Backup date

Product type

Depending on the backup there may be other information available (i.e., IMEI, ICCID, phone number, etc.)

You can select a different backup by clicking Change backup next to the backup name.


6.Define the location for saving the backup and click Restore. The file names in the restored backup will be displayed as in macOS.

  NOTE: The destination location must be empty.

7.The decryption process starts. You can view the number of processed files and the number of errors received during decryption.

restored successfully

8.When decryption is finished, you can click clip0005 to view the processed backup on the local computer.

   If you have Elcomsoft Phone Viewer installed on your computer, you can explore the backup content by clicking the Open in EPV link.

9.To view a detailed report about decrypted files and errors that occurred during decryption, click Details.

10. Click Finish to close the Decrypt Apple backup window.