My sister lost her iPhone a couple of days back and with that all her contacts, notes and calender entries that she had painstakingly stored on the device.
Her only hope of getting all that important data back was the backup that she had taken a couple of days earlier and she asked me to help her out.
This was my first time dealing with an iPhone backup and I didn’t know where to get started trying to recover data from the backup.
Well, truth be told. The iPhone is not the most open among gadgets. And it isn’t easy to get your data off it. Apple has tried it’s best to hide any iPhone related information from the user’s view. And they have succeeded to an extent, atleast the primary consumers of Apple’s goods don’t really care where (or more importantly, how) the data is stored, as long as Apple provides an application to access it.
In the iPhone’s case, the application is iTunes and the only way to put this data back on to the device is to use iTunes … unless you know where to look for it.
On a computer running windows vista, the data backup is stored in the following location:
C:\Documents and Settings\USERNAME\Application Data\Apple Computer\MobileSync\Backup
Under the backup directory, you will see a directory which looks like a unique ID. This is the directory in which the backup is created, everytime you backup your iPhone using iTunes.
In this directory, you will see a number of files with the *.mdbackup extension.
The .mdbackup files are the actual backups of all the applications and settings of your iPhone. So, the first thing you should be doing is, make a backup of these files :-)
If you use an editor to view these files right now, all you’ll see is garbage, cause these are not text files. They are what Apple calls Binary plists. And to decrypt them, you ideally need a Mac and this utility.
I used the command line version of the utility since I only had console access to a mac and that worked for me.
I first copied all the *.mdbackup files, that I had collected from the iTunes backup folder, to the Mac and ran the following command to zero in on the files that actually had any useful data. I was the most interested in the Contacts data, so that’s what I searched for first.
grep ‘AddressBook’ *.mdbackup
AddressBook is the name of the application which stores, well, address book data on an iPhone. It is only named Contacts in the interface. The actual application name is AddressBook and when I searched for that string in the backup files, I got three files as a result.
I opened the first file using a text editor and it turned out to be the one I was interested in. The word AddressBook is in the beginning of this binary file and it also mentions the database name, where all the data is stored. Yay !
So, now to get to that data base file, we need to use the decoding utility that we downloaded earlier.
So, we’ve got our database file. The decode iphone utility will put it in the following folder structure
Open the database with the following command:
and you’ll be dropped to the sqlite prompt. At this point, you need to understand the schema of this database a bit before you can proceed further. Give “.tables” command and you should see the following output.
At this point, I had to use a bit of trial and error to figure out which table holds what data. To view the schema of a particular table you can use the following command.
.schema <table name>
Using this command on the ABPerson table gave me the following result.
There was other information also, but this is basically what I was interested in. So, this particular table was all the information about the a Person, except the phone number. To look for the phone number, I had to look at another table – ABMultiValue. And the two tables are linked through the ROWID and record_id fields in the ABPerson and ABMultiValue tables respectively.
It turns out that the ABMultiValue tables lists all the phone numbers and a quick “select * from ABMultiValue” gave me the answer I was looking for. So, now I finally know where all the data is. To collect all the data in a single place, I used the following SQL query.
select ABPerson.first,ABPerson.last,ABMultiValue.value from ABPerson,ABMultiValue where ABMultiValue.record_id=ABPerson.ROWID
Once I’d confirmed that this was indeed the correct data, I gave the following command on the sqlite prompt
That made sqlite put all output into the backup.txt text file rather than the console. And I was set. Ran the above select statement once again and I had all the phone numbers in a nice text file.
How was that for a weekend project, eh ?
In a future post, we’ll talk about taking out the notes and Calender entries from a backup file. The procedure is almost the same, so if you guys can figure it out yourself till then, post the solution in the comments.