Pull specific app files from an unencrypted iOS backup.

pull_files.py

#!/usr/bin/env python3
# Pull specific files from an unencrypted iOS backup.
#
# ## Examples
#
#     ./pull_files.py ~/backup ~/all_backup_files.zip
#     ./pull_files.py -d '%com.example.app%' ~/backup ~/app_files.zip
import argparse
import pathlib
import sqlite3
import sys
from zipfile import ZipFile

def main():
  parser = argparse.ArgumentParser(description="pull files from iOS backups")
  parser.add_argument("-d", "--domain", default="%", help="domain search pattern, supports SQL LIKE syntax")
  parser.add_argument("input_path", help="backup directory path")
  parser.add_argument("output_path", help="output zip file path")

  if len(sys.argv) <= 1:
    parser.print_help()
    sys.exit(1)
    return

  args = parser.parse_args()
  input_path = pathlib.Path(args.input_path).expanduser().resolve()
  output_path = pathlib.Path(args.output_path).expanduser().resolve()

  with manifest_conn(input_path) as conn:
    file_rows = query_file_rows(conn, args.domain)

    if len(file_rows) == 0:
      sys.exit("No matching files found.")
      return

    with ZipFile(output_path, "x") as zip:
      copy_files(file_rows, zip, input_path)
      copy_contents(file_rows, zip)

def manifest_conn(input_path):
  manifest_path = input_path.joinpath("Manifest.db")
  manifest_uri = manifest_path.as_uri() + "?mode=ro"
  conn = sqlite3.connect(manifest_uri, uri=True)
  conn.row_factory = sqlite3.Row
  return conn

def query_file_rows(conn, domain):
  c = conn.cursor()
  c.execute("SELECT * FROM Files WHERE domain LIKE ? AND flags = 1", (domain,))
  return c.fetchall()

def copy_files(file_rows, zip, input_path):
  for file in file_rows:
    file_id = file["fileID"]
    file_domain = file["domain"]
    file_path = input_path.joinpath(file_id[0:2], file_id)
    print("Copying '{}' from domain '{}'...".format(file_id, file_domain))
    zip.write(file_path, file_id)

def copy_contents(file_rows, zip):
  print("Writing 'contents' file...")
  zip.writestr("contents", "\n".join([str(dict(f)) for f in file_rows]))

if __name__ == "__main__":
  try:
    main()
  except KeyboardInterrupt:
    pass

~LICENSE

Copyright © 2018 Leo Nikkilä

Permission to use, copy, modify, and/or distribute this software for any
purpose with or without fee is hereby granted, provided that the above
copyright notice and this permission notice appear in all copies.

THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
PERFORMANCE OF THIS SOFTWARE.