The easiest way to find a backup file--
so let's say you're working a Mac investigation, which
you can see in the dark screen here, or, in the white screen,
we see a PC.
The easiest way to find it is to search
for the word that is in bold, MobileSync, all one word.
Now, where this becomes a little bit tricky--
there is a native Apple iTunes version for Windows,
and there's also a Microsoft iTunes version.
Depending on which version is installed
will actually control where the data is going to be stored
and also which time stamps you can trust in your examination.
So it's very important that you look at this.
We also have these unique identifiers, or these GUIDs.
The GUIDs, or these unique IDs, are
going to tell you the type of device it is.
So we can see this first one here that ends in 3A.
I have a backup that was created at one time,
and then I have an additional backup that gets a timestamp.
So often, the first backup may not
get the time stamp as part of the container,
but the second backups will.