The Encrypt backup feature in iTunes locks and encodes your information. In this short How To video, Director of Training, Rich Frawley shows investigators how to remove the known iTunes backup password, if required.
An encrypted iTunes backup is used in order to collect as much data as possible from an iOS device. Encrypted backups are known to potentially recover more user data than unencrypted ones. If an encrypted backup was never set up for the target device, then the temporary password “adf” is used and removed once the backup is completed. If an encrypted backup was already set up, then the password has to be provided before the logical acquisition can begin.
If something happens during the backup process you will be advised to remove the backup setting and the password “adf”. In this 3-minute video, Rich shows you step-by-step how to remove the password “adf” from the device.
Follow these steps within your ADF digital forensic software.
iTunes will reset the device to not encrypt backups and start the backup process (this can be canceled). The password is now removed and back to its original status.
Learn more about macOS Forensics or Digital Evidence Investigator PRO for mobile and computer investigations. Investigators that need digital forensic support can leverage the ADF Knowledge Base or contact ADF Support.