With iOS 13, an iTunes backup can produce some of the best evidence. Therefore, it is important to know and understand where it is stored.

Using the standard install of iTunes from the App Store, look under:

  • Users –> the user –> AppData –> Roaming –> Apple Computer –> MobileSync –> Backup

If the user has the iTunes app from the Microsoft Store, the location is different and is located under:

  • Users –> the user –> Apple –> MobileSync –> Backup

From here, you can find the correct date/time stamps which can prove critical to your investigation.

Share this post