Hi All,

Does anyone know if it is possible to determine, if and when an iPod Touch was last backed up from an image of the device? Its not jailbroken and it was a RAM Disk extraction using XRY. The device is an iPod Touch, 4th Gen, with iOS5 installed.

Kind Regards

jm25  

When you say backed up from an image do you mean that the user has selected the "restore" option?

Do you have the PC it was synced to or the device or both?

And do you have a test device to check.
You can check the registry to see the last device that was connected, and you can check in the appdata folder for itunes all of the devices that were connected and synced. I'm not sure if this will have what youre looking for though.  

- jm25

Does anyone know if it is possible to determine, if and when an iPod Touch was last backed up from an image of the device? Its not jailbroken and it was a RAM Disk extraction using XRY. The device is an iPod Touch, 4th Gen, with iOS5 installed.

So, you're asking how to determine when that iPod was last restored from the XRY image that was created?

I'm sorry, but your statement, "...backed up from an image..." is somewhat confusing.  

Sorry for the ambiguity. Unfortunately we dont have the PC it is synced with. Basically we are trying to determine if the iPod was ever backed up to a PC, and if so, when. All we have to work from is an XRY Ram Disk dump.

Thanks  

What your really asking then is if an iPod stores a file locally when it is synced with a PC/Mac.

If it does store something locally then how to find and interpret that information and figure out the date the sync occurred on?

I've never heard of an iPod creating a file locally when it is synced, but even if iTunes did do something like that, there are numerous other tools out there for backing up and dealing with iPods so I think you may be up a creek without a paddle.

What is the end goal here? how does knowing if and when it was backed up assist?  

Thanks for your input. We are just trying to support / refute a claim made by the person in question. Having this information would help with it.

Thanks again  

I got interested in the question in general, and started looking around on Google, and found some things that might be potentially useful. I would think that if there were some such artifacts, they would be found in a plist file.

Caveat: I don't have a means of imaging my own iPod, so I can't test any of this...

I found a presentation from 2009, regarding a file called iSync.vcf, and in the presentation I found (just slides, no audio), it seemed to indicate that there might be something of value there.

Other files that may be of interest:
gtkpod.pref
SysInfo

I found another presentation from 2007 that indicated that there were two files created on the iPod after the device is connected to a system and interacts with iTunes:
\iPod_Control\iTunes\DeviceInfo
\iPod_Control\iTunes\SysInfo