TL;DR — I reverse-engineered iMazing to build my own iPhone migration tool: I mapped how it classifies a backup into data sets (domain / category model), how it draws the line around photos, and then implemented the whole thing myself on top of what iOS does natively — the mobilebackup2 protocol, via pymobiledevice3. The goal is simple: move everything except photos/videos from an old iPhone to a new one, without paying for or depending on iMazing.

Backup works perfectly. Restore does not work at all. The device accepts the restore, writes everything into its own staging area (/private/var/mobile/.backup.i), logs BackupAgent2 =restorable= Restoring attributes …, finishes with ErrorCode 0, reboots — and the data is simply not there. Free space goes back up, i.e. the staging area was discarded.

I've made 9 attempts and eliminated 6 hypotheses by experiment. I'm posting the evidence so someone can tell me where my mistake is, instead of me guessing again.

Environment

• iPhone 15 Pro, iOS 26.6.2, macOS 26.6.2, USB
• pymobiledevice3 11.43.1 (Python 3.11)
• Backup taken from the same device (I know this is unusual — it's a test device I erased)
• Backup: 55.2 GB / 1,202,310 entries, unencrypted (IsEncrypted: false, Version: 10.0, SystemDomainsVersion: 24.0, WasPasscodeSet: true), 130 apps in Info.plist, photos pruned out via patch_manifest
• Restore call in use:

python await Mobilebackup2Service(provider).restore( backup_directory=work_parent, # contains <source_udid>/{Manifest.db,Manifest.plist,Info.plist,Status.plist,...} source=source_udid, reboot=True, copy=True, settings=True, remove=False, skip_apps=False, system=False, )

What works (so you can trust the rest of the setup)

• Backup: 55.2 GB / 1,202,310 entries land on disk; classification of 28 categories validated against a real 133 GB iMazing backup (unmapped domains 1.00% → 0.0004%).
• Export: contacts DB exports with ABPerson 373 rows and ABMultiValue 2027; sms.db with 8054 messages; 143 voice memos are real .m4a. So reading side is solid.

The failure, three variants

(A) copy=False (RestoreDontCopyBackup=True): the full 55 GB streams to the device, progress hits 100%, the client gets a success response. After reboot: 0 user apps installed, free space unchanged (481.8 / 486.2 GB). Info.plist name is restored, so something was applied, but no data.

(B) copy=True (RestoreDontCopyBackup=False): the device starts copying into its own storage — BackupAgent2 logs Creating safe harbor for container … / Writing …, free space drops 499.0 → 495.55 GB in the first ~50 s — but the client's progress callback stays at 0.0% the entire time. I wrongly killed the process at that point in two earlier attempts. When I finally let a small pruned backup run to completion, the command returned 0 after 5.1 minutes and the device logged:

BackupAgent2: =restorable= Restoring attributes u/gid 501/501, b/m/c/atime …, permissions 0755 to <private>

(lots of these — it was restoring attributes for ~136k directories). Then it rebooted, and afterwards: data gone, free space back to the pre-restore value (481.83 → 481.56 during restore, then back to 481.80).

(C) A pruned backup without directory rows produced a very informative error, which I fixed:

ErrorCode 2: '_restoreRegularFiles:size: rename error: No such file or directory (2) at path "/private/var/mobile/.backup.i/var/mobile/Library/Preferences/com.apple.mobilephone.plist"'

Cause: my "fast prune" kept only regular files (flags=1) and deleted directory rows (flags=2), so the device had no parent directory to rename into. Fixing that (keep all flags != 1) removed this error — and let the restore reach case (B).

Gates I've already found and satisfied

These all produce their own errors, and all of them are now cleared before the attempt:

So the restore attempt in (B) starts from: activated, paired, no Apple ID, no Find My, unlocked, preflight all green.

What I've ruled out (by experiment, not by reading)

1. Incomplete backup / pruned photos — case (A) used the unpruned 55 GB backup. Still discarded.
2. Client disconnecting too early — the 5.1-minute run finished on its own with ErrorCode 0; I didn't touch it. Still discarded.
3. Missing directory entries — fixed (case C → B). Doesn't explain the discard.
4. Wrong Status.plist — mine is BackupState: new, SnapshotState: finished (libimobiledevice refuses to restore unless SnapshotState == finished, so this is required and satisfied).
5. Encryption — backup is unencrypted, WillEncrypt == false, no password involved.
6. Target device state (setup assistant vs. desktop) — tried both: from Setup Assistant the service isn't exposed yet (does not offer the requested service); from a completed setup it accepts the restore.

What I suspect, ranked — please correct me

1. The last hop needs Apple's own host. In Finder/iTunes the device reboots mid-restore and then reconnects to the Mac to finish applying data (MobileDevice.framework driving the second phase). With a single mobilebackup2 session that connection is gone, so the device has nobody to serve the remaining data and drops the staged copy. Is that actually how it works? Does mobilebackup2's Restore ever work without the host being re-attached after reboot?
2. **RestorePreserveSettings is inverted in my call.** pymobiledevice3's restore(settings=True) writes RestorePreserveSettings=True, whose meaning (per libimobiledevice source: RestorePreserveSettings = ((flags & CMD_FLAG_RESTORE_SETTINGS) == 0)) is "preserve the target's settings, do not restore the backup's" — the opposite of a Finder restore. For a full restore, should this be false? Could true send the device down a "merge" path that ends up discarding staging?
3. Restoring onto the same UDID as the backup's source takes a special code path. I can't test a cross-device restore (only one test device available, and I must not touch the other phone). Does anyone know if source == target is handled differently?
4. iOS 26 changed the restore flow and the open-source implementations haven't caught up.

My questions

1. Has anyone successfully done a backup restore (not IPSW) on iOS 18/19/26 with libimobiledevice's idevicebackup2 restore or pymobiledevice3? If yes, with which exact option combination, and does it survive the reboot?
2. Is there a documented/observed second handshake after the reboot in Apple's restore flow, and what service does it use? If so, is it reachable outside MobileDevice.framework?
3. What is the correct value of RestorePreserveSettings / RemoveItemsNotRestored / RestoreSystemFiles for a full "make this phone identical to that backup" restore?
4. Any way to see why the device discarded staging — a log level, a preference, or a file under /private/var/mobile/.backup.i or BackupAgent2's own logs (readable from the host)? syslog live only shows live lines; the decisive message is probably printed during the reboot, which I can't capture.
5. Am I fighting something fundamentally not reimplementable, i.e. should I give up on this layer and drive MobileDevice.framework instead? (The alternative is to drop the backup into ~/Library/Application Support/MobileSync/Backup/ and let Finder do the restore — which definitely works, but it's not "my" code doing it.)

Extra detail that may be relevant

• Trimmed backups for a single category: 13 manifest rows + all 136,357 directory rows + 191 special rows. Manifest.db rebuilt and VACUUMed (49 KB). Files hardlinked, not copied. This is what case (B) used.
• Device-side logs I can see with pymobiledevice3 syslog live: Creating safe harbor for container …, Writing …, =restorable= Restoring attributes …, and during backup =scanning= Not backed up (attribute) Added regular file.
• I never see anything like "restore complete/failed" after the reboot.
• The device ends up activated and empty after the attempt (free space as before, 0 user apps), i.e. it erased itself and then didn't apply the backup.

Happy to share the exact commands, the manifest layout, or run any experiment that would be informative — the device is a dedicated test unit and I can wipe it freely. What would you test next?

Appendix A — raw device responses (personal data removed)

These are the unmodified payloads the device returned, in the order I hit them.

(1) Backup, screen locked

{'ErrorCode': 208, 'ErrorDescription': 'Device locked (MBErrorDomain/208)', 'MessageName': 'Response'}

(2) Restore, Find My iPhone still enabled

{'ErrorCode': 211, 'ErrorDescription': 'Find My iPhone must be disabled before restoring (MBErrorDomain/211)', 'MessageName': 'Response'}

(3) Restore on a non-activated device

pymobiledevice3.exceptions.InvalidServiceError: The device does not offer the requested service.

(4) Restore, after my bad prune (this one was my bug and is now fixed)

{'ErrorCode': 2, 'ErrorDescription': '_restoreRegularFiles:size: rename error: No such file or directory (2) at path "/private/var/mobile/.backup.i/var/mobile/Library/Preferences/com.apple.mobilephone.plist" (MBErrorDomain/2). Underlying error: The operation couldn't be completed. No such file or directory (NSPOSIXErrorDomain/2).', 'MessageName': 'Response'}

(5) The "successful" restore that still lost everything — device-side log during the run

BackupAgent2[648] <INFO>: Creating safe harbor for container <private> with type <private> at <private> BackupAgent2[648] <DEBUG>: Creating directory <private> BackupAgent2[648] <DEBUG>: Writing <private> BackupAgent2[522] <INFO>: =restorable= Restoring attributes u/gid 501/501, b/m/c/atime 1792477268/1792477268/1792477268/1793029156, permissions 0700 to <private> ... (thousands of these, for ~136k directories)

Then the host side printed 恢复流程已结束 / restore returned 0, and after the reboot:

before restore : free 481.83 GB during restore : free 481.56 GB (i.e. ~0.27 GB written to staging) after reboot : free 481.80 GB (staging gone, nothing applied) user apps after: 0

Appendix B — the exact options I send

RestoreShouldReboot = True # reboot when done RestoreDontCopyBackup = False # => copy the backup into device storage first RestorePreserveSettings = True # pymobiledevice3's default. In libimobiledevice, # this is set TRUE when -s ("restore settings") is NOT given, # so it appears to mean "keep the target's settings" RestoreSystemFiles = False RemoveItemsNotRestored = False

For a "make this phone identical to that backup" restore, should RestorePreserveSettings be false? And does RestoreDontCopyBackup = false (copy first) conflict with that?

Appendix C — what I can share on request

No personal data in any of it:

• the full Manifest.db schema plus sample rows for one category,
• the complete host-side log of all restore attempts,
• the sanitized restore code path,
• a trimmed one-category backup (a few MB) that reproduces the discard, so someone can try it on their own device.

Hello! My company currently has a Talino being used as our work station for all things computers and DVR’s. I use programs like FTK Pro and Forensic Explorer. My issue is this Talino is older and it’s SLOW. The last guy in my position took it home with him (for whatever reason🙄) & basically wiped the entire thing before returning it to us. After returning it, it runs soooooo slowly. It will even shut down randomly in the middle of doing work.

Does anyone have recommendations on a new computer or the specs needed for me to efficiently work on it for computer forensics?

how disk image a macbook pro intel9 processor and other device macbook air m4 chip pls ASAP

Hello,

I’m a first-year college student studying computer forensics and digital investigations with the goal of eventually joining the ICAC Task Force or a Computer Crimes Task Force for an agency. I was wondering if anyone knows of any scholarships, regardless of the amount, that exist for computer/digital forensics. I am on the President’s List and hold a 4.0 GPA and have never gone below, if that helps!

Hi everyone, for context I'm a 30 year old woman. I've been working random jobs for all of my 20's, mostly in the trades. My current job is with a small handywoman company (just me and my boss) and I love it but she just cut my hours because she can't afford to pay me full time right now.

Long story short, my friend's Dad owns a digital forensic company and has done really well for himself. He offered me part time work at his company even though I have no experience whatsoever in this field. We've been getting along great and he just offered me full time... with a salary and benefits... which I've never had before. Just the starting pay is more than I've ever made and I'm most likely going to take the job but am feeling overwhelmed. I'm also a musician as my main passion/hobby outside of work and working as a handywoman has been super flexible and conducive with that lifestyle.

He has one other employee, also a woman my age, and I would be able to get to work from home part of the time and the commute is great. He told me they'd train me and he'd pay for me to get certified (whatever that means lol)... I guess I'm just wondering what people's experiences are in this field? And what your work/life balance is like? Anything you'd like to tell me basically I would be happy to hear about. I've never had a desk job or a computer job before so it will be a huge shift for me but I also could really use the money since I've basically lived paycheck to paycheck my entire life... Thanks for reading!

Working a case where the timeline of a crash matters a lot (speed, braking, whether a phone was connected). Everyone mentions the event data recorder, but I keep hearing infotainment systems store way more: call logs, paired devices, GPS history.

For anyone who's done vehicle forensics or hired someone who does: what have you realistically been able to recover, how long after the crash is it still there, and what did you need legally before anyone touched the car?

I have 3 Tableau TD-3 Forensic Duplicators that are old, but (were) still working perfectly fine. Occasionally i still used them when I had to do a lot of disk acquisitions. However, when I wanted to use them last week, none of them worked anymore, simply dead bricks. Checked power supplies and fuses but everything seemed to be in order. It literally looks like there was some sort of kill switch executed at a certain date and time. Is there anyone that still has a TD-3 that is working? I tried to reach out to OpenText but as usual you are only being referred to non descriptive articles and legal documents. Cheers!

Trying to budget for a crash case. We can do a phone extraction (with consent) or a vehicle infotainment/EDR pull, probably not both.

In your experience, which one usually answers the 'was the driver distracted' question better? Or is it truly case-by-case?

I have posted here before asking about what I should do because I am graduating soon and cannot find any work, so maybe it is something with my resume? My campus office reviewed and helped me make it, but just in case it’s not tailored correctly I wanted to get opinions here. Thank you in advance!

EDIT: Updated resume here! Thank you for your feedback!

Im looking for any information or starting points I can get for getting education and a career in computer forensics

Hello all

We have a couple of Windows devices in the past that either had Bitlocker suspended or "Waiting for Activation". The latter is often the case with freshly shipped Windows 11 devices. In those cases, the the volume is encrypted using a clear key protector, see:

https://learn.microsoft.com/en-us/windows/security/operating-system-security/data-protection/bitlocker/planning-guide#bitlocker-provisioning

There is no active key protector (i.e. no recovery key, no password or anything) that could be extracted.

In those cases, we can image the device with for example FTK Imager, but when opening the image, FTK cannot read it. However, when we for example mount it in Windows as a volume in FTK Imager, the whole disk is readable.

Does anyone know how to avoid this issue, which tools (e.g. Encase, X-Ways, Autopsy,...) have no issue with reading the E01 or how you typically deal with this?

We want to of course avoid changing any setting on the device before acquiring the disk and we would like to directly work on the physical acquisition / E01.

Hi al i wanna study FOR500 specially windows DFIR and i wanna a free resources not a stolen resources

I'm investigating an unexplained ACL change on a Windows 10 Pro 19045 NTFS volume.

A folder was created on E:\ at 22:27:07 on 2026-10-03 and initially inherited an Authenticated Users (AU) ACE. By 22:54:19, the ACE and inheritance were gone.

I'm trying to determine what process/account caused the change.

What I checked

I collected and examined Security.evtx, SYSTEM/SOFTWARE hives, BAM/DAM, Prefetch, ActivitiesCache, Amcache, NTFS Operational and Storport logs.

Key findings:

No 4670 events in the available Security log retention.

icacls.exe first Prefetch creation: 23:04:50 (after the window).

No takeown.exe Prefetch or BAM entry.

No ACL-capable executable appears in BAM during the window.

PowerShell 5.1 was not running during the window.

cmd.exe was active 22:27:29–22:33:29, but its command history is unavailable.

Explorer was active around the event.

pwsh.exe cannot be confirmed or excluded.

No useful NTFS/storage event links to the change.

The relevant window is approximately:

22:27:07 → 22:54:19

Question

Is there another Windows forensic artifact or technique I should check that could identify the process/account that modified the security descriptor?

Or is this simply impossible to attribute retrospectively because File System Object Access auditing/SACLs were not enabled?

I'm particularly interested in artifacts that could distinguish an explicit ACL write from inheritance/security-descriptor behavior during folder creation.

EDIT: shortened and added red flags

I’m posting this for a friend who was seriously hurt while on electric scooter crossing on green light using pedestrian crossing.

There are some concerns about the dashcam video that was provided afterward by the driver who hit her, and we’re trying to figure out whether it’s worth hiring a digital forensics investigator to look at it.

Her lawyer says the video is fine, and if she wishes to challenge it she has to pay put of pocket

My friend remembers the vehicle approaching in one lane, changing lanes, and then hitting her. But in the video we were given, the clip only starts a few seconds before the impact, and the vehicle already appears to be in the lane where the collision happens.

Red flags we’ve found with the dashcam video:

The metadata contains “WXVer,” which appears to be connected to WeChat, and the file creation date is later than the date shown inside the recording. That strongly suggests the file we received is not the untouched original dashcam file and went through some kind of processing/export/sharing first.

The resolution is only 480×360. That seems extremely low compared with what the dashcam would normally record, so a lot of the original image detail has been lost.

The file is a MOV/H.264 file that has been re-encoded. So this is not the original camera recording in its native form. Re-encoding can also remove some of the technical information.

If you’re a digital forensics investigator and would be willing to review the video, please DM me.

Hi all,

I’m working on a case with a USB drive that appears to be encrypted with FileVault. The drive was already imaged and we allegedly have the password, but I’m looking for a way to decrypt/image the FileVault partition without altering the data.

I’m hoping someone can point me in the right direction. Does this drive need to be connected to a Mac computer to enter the password, or is there other software that can perhaps mount the image on a Windows machine? Maybe Mount Imager Professional?

If the drive has to be connected to a Mac computer, what’s the best way to image just that partition? (There were other partitions on the drive that were not encrypted.)

Years ago, there was FTK Imager for Mac - I’m not sure if that is still around and supported.

Any insight is appreciated. Thanks in advance.

Does anyone have forensic articles that reference time machine backups? Like if a macOS has 6 backups stored do you need to process all?

I've been picking through a SCADA-style telemetry capture and I can't explain what I'm seeing.

The file has 14 authorisation records, each with its own CRC. All 14 validate. The file header carries a CRC-32 over the whole block, and that one fails. Two of the operator-name fields are zeroed.

My reading is that someone blanked those fields, recomputed the per-record CRCs so they'd pass, and never touched the block CRC. But I'd like a sanity check — is there a corruption mode that breaks a block checksum while leaving every record checksum intact?

File (8.8MB): www.[st88openocean.github.io/slip-three/MCA-CTL-0314-RAW.slice](https://st88openocean.github.io/slip-three/MCA-CTL-0314-RAW.slice)

Published digests for it are here: www.[st88openocean.github.io/slip-three/archive](https://st88openocean.github.io/slip-three/archive)

Greetings, I hope all is well! Long story short, recently got my Masters in Digital Forensics, and I also have received an opportunity for a digital forensics technician role for a local LE agency. I am just wondering if anyone here works for one, and also what to expect, as I myself come from an IT support background. Thanks!

Edit: Expectations, just realized I made a typo in my title

Trying to pin down where DFIR services end and dedicated ransomware incident response begins, because vendor conversations blur the line constantly and I want to make sure we're buying the right coverage. My read so far is that DFIR is broader (forensics and investigation for any incident type, with evidentiary rigor and chain of custody if it needs to hold up for insurance or litigation), while ransomware-specific response bundles in things unique to that scenario, like negotiation support and recovery sequencing around double-extortion threats. Is that distinction accurate or mostly marketing language that falls apart once you're in an engagement?

Hii guys, first time into this sub. Basically i just graduated last month from Comp Sci and I have fortunately enough to get into the big4 (green one) forensics and financial crime BU, specifically DF & Ediscovery team. Our team is relatively small, ~10 peeps including boss.

What are the things i need to learn / carry the most weight, both soft and hard skills. Cause I am kinda worry not up to expectation of my boss and I do not have much security course experience besides those IT fundamental. Do i need to start doing course from platform like HTB/ CyberDefenders?

https://www.justice.gov/usao-cdca/pr/tech-ceo-russian-national-arrested-complaint-alleging-they-hid-russian-ownership-and

CEO is facing 20 years in prison.

We've been looking into them as a vendor, but found some things that are giving me pause - for one, their website seems to be completely broken. Can't navigate to it, and an email got bounced back to us, also seeing a bunch about Russian ties..is there any merit to those rumors?

i need the data thats required for the hnads on project for Guide to Computer Forensics and Investigations

Hi I just asked this in [r/digitalforensics](r/digitalforensics) too, I hope that's okay, I don't mean to break the no reposts rule.

I want to extract some Windows Registry artefacts from a VMware Pro 17 VM using the .vmdk file, in FTK Imager. Is this possible?

I tried doing this in FTK Imager so far:
File > Add Evidence Item > Image File > selecting the path to my .vmdk file of the VM > Finish

But I get this error:
Path "path to the .vmdk file" does not contain valid evidence. Details: Image detection failed.

I made the .vmdk file by exporting the VM as a .ovf from within VMware Pro.
I am on Windows 11, using Exterro FTK Imager 8.3.0.27.

I have extracted Windows Registry artefacts from .E01 files in class with FTK Imager, as just the regular export, and as a Custom Content Image for forensic integrity. I am trying to use the same process for the .vmdk file - sorry if this is a noob move.

I have searched the User Guide PDF for vmdk and virtual disk images, and I didn't find anything, so I'm hoping someone here might know.

This is for a school project, it's a plain Windows 10 Pro VM with no actual personal data or anything, I made it for this project.

Thank you for your help!

---
Edit: Two awesome people in the other post helped me! so I had made a copy of the .vmdk, stored in OneDrive, and was trying to load that into FTK Imager, when I should have been using the .vmdk from the VMware VM directory directly! I was really over complicating things. Thank you for your help here too!