The Encrypt backup feature in iTunes locks and encodes your information. In this short How To video, Director of Training, Rich Frawley shows investigators how to remove the known iTunes backup password, if required.
An encrypted iTunes backup is used in order to collect as much data as possible from an iOS device. Encrypted backups are known to potentially recover more user data than unencrypted ones. If an encrypted backup was never set up for the target device, then the temporary password “adf” is used and removed once the backup is completed. If an encrypted backup was already set up, then the password has to be provided before the logical acquisition can begin.
Learn How To Remove the iTunes Backup Setting and Password
If something happens during the backup process you will be advised to remove the backup setting and the password “adf”. In this 3-minute video, Rich shows you step-by-step how to remove the password “adf” from the device.
Steps to Remove the iTunes Password
Follow these steps within your ADF digital forensic software.
- First, open iTunes and connect the device with the password set.
- Next, select the phone icon in the toolbar to access the phone properties.
- Go to the Backups section and deselect Encrypt local backup.
- You will be prompted for the password to unlock the backup, enter “adf”.
- You will be prompted for the device password (on the device) enter it
- You will be prompted “do you want backups to be encrypted?
- Select Don’t encrypt.
iTunes will reset the device to not encrypt backups and start the backup process (this can be canceled). The password is now removed and back to its original status.
Learn more about macOS Forensics or Digital Evidence Investigator PRO for mobile and computer investigations. Investigators that need digital forensic support can leverage the ADF Knowledge Base or contact ADF Support.
