Introduction: A graphical tool that can extract and replace files from encrypted and non-encrypted iOS backups
More: Author   ReportBugs   

iTunes Backup Explorer is a graphical open-source tool that can show, extract, and replace files in iPhone and iPad backups.

It supports both encrypted and non-encrypted backups, currently from iOS 10.2 onwards.

Most programs that support encrypted backups are either limited trials or expensive. There are apparently only very few open-source projects that target this issue and none that are also useful for the average user.

Program screenshot


  • Open your terminal and type in java -version.
  • If the command was not found or the version is below 11, download and install Java for your operating system, e.g. from here.
  • Download the jar file of the latest release of iTunes Backup Explorer.


  • Simply double-click the downloaded file to start the program.
  • From the command line: java -jar JARFILE.jar. Replace JARFILE.jar with the name of the file you downloaded.


  • cd to the download directory and type in chmod +x JARFILE.jar.
  • You may need to enable Full Disk Access in System Preferences -> Security -> Privacy for the Jar Launcher or /
  • Now, you should be able to simply double-click the file to start the program.
  • If that does not work, you may need to type java -jar JARFILE.jar into the terminal to run it.


  • cd to the download directory and type in chmod +x JARFILE.jar.
  • Depending on your specific system, you should be able to double-click the file to start the program.
  • If that does not work, use java -jar JARFILE.jar to run it.

In the "File Search" tab, you can search for files using case-insensitive SQLite LIKE syntax. It supports two wildcards: % and _.

  • % matches any sequence of zero or more characters.
  • _ matches any single character.
  • \ is used as the escape character.

Here are a few examples:

Domain Relative Path
Videos in the camera roll CameraRollDomain
Files under the DCIM directory CameraRollDomain Media/DCIM/%
All .sqlite files % %.sqlite
.db databases in the home domain HomeDomain %.db
All WhatsApp files %whatsapp% %
App documents on iCloud HomeDomain Library/Mobile Documents/iCloud~%
All files (can take a bit of time) % %

After you clicked on the Search button, you can also sort by clicking on a column name.

To find the largest files, type in a query, click on Search and then twice on Size.

With the Export matching button on the bottom right, you can export all files that match your query to a directory you choose.

By right-clicking on a file row, you can open, extract, replace or delete a single file. This works the same as in the hierarchical "Files" tab. If it is a symbolic link, you can show the target location.


For me, this was a matter of course, but it was pointed out that I should clarify it anyway. I do not collect any personal data. In fact, the program does not even use an internet connection at this time. If that should change at some point in the future, I will update this notice.


I started looking into this after I saw this brilliant answer on StackOverflow by andrewdotn to a question that has already been viewed more than 220.000 times. It explains in detail how iOS backups are structured and how they are encrypted, even providing a working code example.

So a huge thanks to him,

his sources iPhone Data Protection in Depth, iOS Hacker's Handbook, a GitHub comment, the iphone-dataprotection project and the Apple iOS Security Guide for iOS 11 (in the Web Archive)

and Forensic Analysis of iTunes Backups by Jack Farley

About Me
GitHub: Trinea
Facebook: Dev Tools