Determine if and wh...
 
Notifications
Clear all

Determine if and when iPod was backed up?

10 Posts
5 Users
0 Likes
409 Views
 jm25
(@jm25)
Posts: 29
Eminent Member
Topic starter
 

Hi All,

Does anyone know if it is possible to determine, if and when an iPod Touch was last backed up from an image of the device? Its not jailbroken and it was a RAM Disk extraction using XRY. The device is an iPod Touch, 4th Gen, with iOS5 installed.

Kind Regards

jm25

 
Posted : 04/12/2012 10:46 pm
(@randomaccess)
Posts: 385
Reputable Member
 

When you say backed up from an image do you mean that the user has selected the "restore" option?

Do you have the PC it was synced to or the device or both?

And do you have a test device to check.
You can check the registry to see the last device that was connected, and you can check in the appdata folder for itunes all of the devices that were connected and synced. I'm not sure if this will have what youre looking for though.

 
Posted : 05/12/2012 2:00 am
keydet89
(@keydet89)
Posts: 3568
Famed Member
 

Does anyone know if it is possible to determine, if and when an iPod Touch was last backed up from an image of the device? Its not jailbroken and it was a RAM Disk extraction using XRY. The device is an iPod Touch, 4th Gen, with iOS5 installed.

So, you're asking how to determine when that iPod was last restored from the XRY image that was created?

I'm sorry, but your statement, "…backed up from an image…" is somewhat confusing.

 
Posted : 05/12/2012 2:25 am
 jm25
(@jm25)
Posts: 29
Eminent Member
Topic starter
 

Sorry for the ambiguity. Unfortunately we dont have the PC it is synced with. Basically we are trying to determine if the iPod was ever backed up to a PC, and if so, when. All we have to work from is an XRY Ram Disk dump.

Thanks

 
Posted : 05/12/2012 2:57 am
Adam10541
(@adam10541)
Posts: 550
Honorable Member
 

What your really asking then is if an iPod stores a file locally when it is synced with a PC/Mac.

If it does store something locally then how to find and interpret that information and figure out the date the sync occurred on?

I've never heard of an iPod creating a file locally when it is synced, but even if iTunes did do something like that, there are numerous other tools out there for backing up and dealing with iPods so I think you may be up a creek without a paddle.

What is the end goal here? how does knowing if and when it was backed up assist?

 
Posted : 05/12/2012 5:24 am
 jm25
(@jm25)
Posts: 29
Eminent Member
Topic starter
 

Thanks for your input. We are just trying to support / refute a claim made by the person in question. Having this information would help with it.

Thanks again

 
Posted : 05/12/2012 2:18 pm
keydet89
(@keydet89)
Posts: 3568
Famed Member
 

I got interested in the question in general, and started looking around on Google, and found some things that might be potentially useful. I would think that if there were some such artifacts, they would be found in a plist file.

Caveat I don't have a means of imaging my own iPod, so I can't test any of this…

I found a presentation from 2009, regarding a file called iSync.vcf, and in the presentation I found (just slides, no audio), it seemed to indicate that there might be something of value there.

Other files that may be of interest
gtkpod.pref
SysInfo

I found another presentation from 2007 that indicated that there were two files created on the iPod after the device is connected to a system and interacts with iTunes
\iPod_Control\iTunes\DeviceInfo
\iPod_Control\iTunes\SysInfo

 
Posted : 05/12/2012 5:04 pm
keydet89
(@keydet89)
Posts: 3568
Famed Member
 

All of the information in my previous post was found in under 20 minutes, via Google.

 
Posted : 05/12/2012 5:05 pm
 jm25
(@jm25)
Posts: 29
Eminent Member
Topic starter
 

@keydet89, thanks for the reply and the information. I'll hopefully be getting my hands on an iPod Touch to do some tests on. Micro Systemation also had some advice. They recommened looking at the ADDataStore.sqlitedb file. You're a better googler then me, all I kept getting back was information on how to recover data from Backups.

I'll let you know how i get on.

Thanks

 
Posted : 05/12/2012 5:26 pm
jaclaz
(@jaclaz)
Posts: 5133
Illustrious Member
 

@keydet89
Maybe - and with all due respect - it would be nice if you could provide the links to the actual results of your successful googling.

I found this
http//www.computer.org/comp/proceedings/hicss/2007/2755/00/27550267c.pdf

10.1 Key Files of Interest .
As indicated in Sections 6 and 7above, on both the
Windows and Macintosh format iPod there were two
key files containing useful information. The
\iPod_Control\Device\SysInfo file is placed on the
iPod when the system software was restored and
contains valuable data about the iPod.
The \iPod_Control\iTunes\DeviceInfo file is the
other significant file created after iTunes has linked the
iPod with a computer; this file will contain the name of
the user and computer involved in the linkage.

jaclaz

 
Posted : 05/12/2012 5:38 pm
Share: