It is very important to understand if a backup is encrypted or not, regardless of which tool was used.

Here are some clues to determine if it is unencrypted:

  • Under Analyzed Data, there is no activity.

  • Missing call logs (starting with iOS 13, call logs are only captured if the backup/extraction is encrypted).

  • Missing Safari under web history.

Although some may think that the user just didn’t have the above items on the device, it is not usually the case, and they would have appeared in the dump if it was encrypted.

Share this post