Now, this slide I know looks really confusing and busy,
but it's super important.
So we're going to do some date/time comparisons.
And remember, we are not trusting the Windows date/time
stamps.
In each of these, we are looking at the time stamps
within the plist.
So here, on the left-hand side, we
see AppData Roaming, AppData Roaming, AppData Roaming.
This is the native version of iTunes.
Manifest.plist has a date of 9/22/2019 at 09:31:47,
Status at 09:50:19, Info at 09:50:49.
So the truth of this is someone did a backup on Heather's
iPhone using iTunes.
They encrypted it at 09:31:47.
It completed at 09:50:19.
And it finally cached to the PC at 09:50:49.
That is the literal path you want to walk.
Now, I'm going to throw you throw a loop here.
If the Microsoft version of iTunes is used,
some of the artifacts that we're looking at
aren't going to take place or be pertinent to this.
Status.plist, 6/15/2018, Manifest.plist, 6/15/2018.
So here we can see at 09:03:39, 09:20:09.
However, look at Info.plist down here.
9/9/2019, so you're, like, wait a second.
That's a year difference.
The truth of this--
and this was through thorough testing again--
I created a backup on 9/9/2019 around 21:05.
Now, notice I'm saying around because you
can see the seconds difference that it
takes to cache Info.plist.
Someone had used the real version of iTunes on 6/15/2018.
They encrypted it at 09:03:39 and it completed at 9:29
09:20:09.
So there's another backup that exists
for this device on someone's computer.
It was not on mine.
So this was a phone of a friend.
Her sister had died, and she wanted
to see if I could get the photos for her.
So I told her what I would do is create a backup
and give her access to it, and she could do what she wanted.
I created that backup on 9/9/2019, which is Info.plist.
It was not at this exact time.
It was right before that.
So just be careful how you word it.
But clearly, her sister had done a backup before.
She encrypted it at 09:03, and it completed at 09:20 on June
15, 2018.
So I know this can be really confusing.
Look at the file path.
If it's native iTunes, and we see it
in Apple Computer MobileSync, the Status.plist
is our best time stamp.
Manifest is one encryption was changed,
and Info is when it cached to the system.
If it's the Microsoft version of iTunes,
it's going to be in Apple MobileSync Backup.
You cannot trust Manifest.plist.
You can not trust Status.plist.
You can only say, right before this time om Info,
that that backup was created.