ibtk is a command-line toolkit for recovering your own data from unencrypted iOS backups. It exposes one CLI with a subcommand per data type, for example ibtk extract-messages.

What it recovers

• Messages and their attachments
• Photos
• Contacts
• Calendar
• Bookmarks
• Audio

Why a toolkit and not a one-off script

ibtk grew out of a one-off investigation into a single iPhone backup. Generalizing that work meant turning it into a reusable tool with a subcommand for each data type.

How iOS backups are laid out

An iOS backup does not store files under their original names. Files sit in a flat, hash-named structure, and an index database (Manifest.db) maps each hashed name back to a logical domain and path. Messages, contacts, calendars, and bookmarks then live inside SQLite databases of their own.

Any extractor therefore has to:

1. Resolve the real file through the manifest instead of guessing at paths.
2. Query the app databases directly.
3. Convert Apple’s epoch timestamps into real dates.

Skipping any of these gives output that looks plausible but is wrong: missing attachments, or dates decades off.

Scope and responsible use

ibtk works on unencrypted backups that you own. It does not defeat backup encryption. It is for recovering your own data, such as photos from a dead phone or a message thread you need to preserve.

🔗 Repository on GitHub