Now that you have a backup, whether you recovered it
from iCloud, iTunes, Finder on a Mac,
or you created it forensically, what are you going to do?
You are going to look at that file system
for all the databases and plists we already discussed.
Now, keep in mind, if you encrypt it,
you will get more data.
If you don't encrypt, you won't get as much data.
Use your cheat sheets.
Know that anything that requires a full file system
extraction will not exist here.
We also have unique plist files that
come with every single backup.
We have Info.plist, Manifest.plist,
and Status.plist.
I'm going to discuss what each of those
represent to you here in a moment.
We also have Manifest.mdbd and Manifest.db.
While these files may not be of forensic value,
you need to know what they look like just in case you're
questioned on why they exist.