One of the most common requests attorneys receive is: tell me what is on this phone. If the device owner created an iTunes or iCloud backup, you can often answer that question without touching the physical device. This guide walks through the process using ExtractPhone’s browser-based forensic report generator.
What You Need Before You Start
- An iPhone backup file (iTunes local backup or iCloud backup export)
- A modern web browser (Chrome, Edge, or Firefox)
- Access to extractphone.com/report-generator
No software installation is required. ExtractPhone runs entirely in your browser and processes all data locally on your machine.
Step 1: Locate the iPhone Backup
iTunes Backup on Windows
iTunes backups on Windows are stored in the AppData folder under Apple Computer, MobileSync, Backup. Each backup is stored in a folder named with a long alphanumeric device identifier. Check modification dates to identify the most recent backup.
iTunes Backup on Mac
On macOS, iTunes backups are stored in the Library folder under Application Support, MobileSync, Backup.
iCloud Backup Export
If the device owner used iCloud backup, you can request an Apple data export through Apple’s Privacy portal at privacy.apple.com using the Apple ID credentials. The export includes iCloud Drive, photos, messages if iCloud Messages is enabled, and other synced data.
Step 2: Open ExtractPhone
Navigate to extractphone.com/report-generator. No account creation is required to start an analysis.
Step 3: Upload the Backup File
Click Select Backup and navigate to the backup folder. If the backup is a folder (typical for iTunes backups), compress it to a .zip file first. ExtractPhone accepts both zipped and unzipped backup formats. Processing happens locally in your browser. A typical iPhone backup of 5 to 20 GB processes in a few minutes.
Step 4: Review the Data Summary
Once processing completes, ExtractPhone displays a summary: total SMS and iMessage conversations, call log entries, contacts, photos and videos, browser history entries, and app data. Review this summary to confirm the backup contains the data relevant to your case before generating the full report.
Step 5: Configure Report Options
Configure a date range filter to narrow the report to the relevant period, select which data categories to include, and add case metadata such as case number and attorney name to the report header.
Step 6: Generate and Export the Report
Click Generate Report to produce the final PDF. The report includes a table of contents, data organized by category, individual message threads with timestamps, and a hash verification record for the source backup file. The hash record is critical for chain-of-custody documentation, proving the analyzed backup has not been modified.
When to Call a Professional
ExtractPhone covers a wide range of cases, but professional forensics is needed when the device is passcode-locked and no backup exists, deleted data recovery is required, the device is damaged or wiped, expert witness testimony is needed, or encrypted backup files must be analyzed. Contact Octo Digital Forensics for those situations.
FAQ
Can I analyze an encrypted iPhone backup with ExtractPhone?
Encrypted backups require the backup password to decrypt. If you have the password, decrypt the backup using iTunes first, then upload the decrypted version to ExtractPhone.
Does ExtractPhone recover deleted messages?
ExtractPhone analyzes the backup file as-is. If deleted messages are present in the SQLite databases and have not been overwritten, they may appear. For dedicated deleted data recovery, a physical forensic extraction is required.
How long does report generation take?
For a typical iPhone backup of 10 to 15 GB, the full report generates in under 5 minutes on a modern computer.
Try ExtractPhone free at extractphone.com/report-generator
Need full-service iPhone forensics including physical extraction and deleted data recovery? Octo Digital Forensics provides court-ready forensic services. Call 858-692-3306 or book a free consultation.
