IOS 9.3

[athegs]

I have about 3gb of backup in my account but the inflatableDonkey cant find the device. Its ok with ios 9 but not with 9.3 any solutions ?

[horrorho]

It's possible that the backup itself is stored as an iOS 8 backup and hasn't been migrated. InflatableDonkey doesn't recognise iOS 8 backups. I'd initially suggest giving either iLoot or LiquidDonkey a whirl to see if they pick it up.

[athegs]

I use iloot but got the same problem

[horrorho]

When was the backup created and on what device/ iOS version? Was the backup process interrupted at all?

[athegs]

Iphone 5 but i dont remember the ios version. the process it was ok not interrupted

[horrorho]

How long ago was the backup created?

[athegs]

i dont remember

[horrorho]

Has it been over a year? The reason I'm pushing for an answer is because if the backup was created prior to about September 2015 then it's unlikely to be iOS 9.

[athegs]

maybe 7-8 months ago but if the backup is ios8 then the iloot have to work.

[horrorho]

Ok. Just to double check, are there any additional warnings that InflatableDonkey is printing out? Also are you using any filtering options when running the tool?

[athegs]

[main] WARN c.g.h.i.data.der.KeySet - ** KeySet() - bad checksum OR code failure
Output folder:....
"No Device/ snapshots" and not any filter options

[horrorho]

Ok, if you're comfortable editing the source files. Could you please navigate to where you downloaded InflatableDonkey then find InflatableDonkey-master/src/main/java/com/github/horrorho/inflatabledonkey/Backup.java and replace it with this Backup.java. Re-compile the program and run.

This will print out two error lines and then exit the program:

16:36:35.406 [main] ERROR c.g.horrorho.inflatabledonkey.Backup - -- test() - backup: Optional[BackupAccount{, hmacKey=Optional[xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx], devices=[D:xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx]}]
16:36:35.407 [main] ERROR c.g.horrorho.inflatabledonkey.Backup - -- test() - devices: [Device{deviceID=D:xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx, snapshotIDTimestamps=[SnapshotIDTimestamp{snapshotID=S:xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx, timestamp=2016-00-00T00:00:00Z}, SnapshotIDTimestamp{snapshotID=S:xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx, timestamp=2016-00-00T00:00:00Z}, SnapshotIDTimestamp{snapshotID=S:xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx, timestamp=2016-00-00T00:00:00Z}]}]

If would kindly let me know what the output is.

** Please xxx out the hash numbers as I have done. **

[athegs]

03:02:18.176 [main] ERROR c.g.horrorho.inflatabledonkey.Backup - -- test() - backup: Optional[BackupAccount{, hmacKey=Optional[xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx], devices=[D: xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx]}]
03:02:18.177 [main] ERROR c.g.horrorho.inflatabledonkey.Backup - -- test() - devices: [Device{deviceID=D: xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx, snapshotIDTimestamps=[]}]

[horrorho]

Thank you. Ok, it's picking up a single device but there are no snapshots associated with it. There is nothing for InflatableDonkey to download. If you want to double check what the iCloud server is giving us I can give you another file to replace, but it will involve a little more blanking out hash values. It's your call.

[athegs]

if that will help me solve my problem and make a better program then yes we can continue

[horrorho]

Ok! If you would kindly navigate to InflatableDonkey-master/src/main/java/com/github/horrorho/inflatabledonkey/cloud/clients/DeviceClient.java and replace it with DeviceClient.java.

This will produce a longer statement starting with:

17:10:22.928 [main] ERROR c.g.h.i.cloud.clients.DeviceClient - -- test() - responses: [record {
  etag: "g38"
  RecordIdentifier {
    value {
      name: "D:xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
      type: 1
    }
    zoneIdentifier {
      value {
        name: "mbksync"

...

Again please edit out any hash numbers/ serial numbers/ UUIDs/ personal information you see. You don't need to preserve the length of any field you hash out, just put a single x in there.

[athegs]

> 03:42:13.359 [main] ERROR c.g.h.i.cloud.clients.DeviceClient - -- test() - responses: [record {
>   etag: "453"
>   RecordIdentifier {
>     value {
>       name: "D:x"
>       type: 1
>     }
>     zoneIdentifier {
>       value {
>         name: "mbksync"
>         type: 6
>       }
>       ownerIdentifier {
>         name: "x"
>         type: 7
>       }
>     }
>   }
>   type {
>     name: "Device"
>   }
>   createdBy {
>     name: "x"
>     type: 7
>   }
>   timeStatistics {
>     creation {
>       time: 4.70954721987E8
>     }
>     modification {
>       time: 4.85218096353E8
>     }
>   }
>   recordField {
>     identifier {
>       name: "pendingSnapshotBackupType"
>     }
>     value {
>       type: 7
>       signedValue: 0
>     }
>   }
>   recordField {
>     identifier {
>       name: "pinnedSnapshots"
>     }
>     value {
>       type: 16
>     }
>   }
>   recordField {
>     identifier {
>       name: "serialNumber"
>     }
>     value {
>       type: 3
>       stringValue: "x"
>     }
>   }
>   recordField {
>     identifier {
>       name: "snapshotCommittedDates"
>     }
>     value {
>       type: 16
>     }
>   }
>   recordField {
>     identifier {
>       name: "hardwareModel"
>     }
>     value {
>       type: 3
>       stringValue: "N42AP"
>     }
>   }
>   recordField {
>     identifier {
>       name: "pendingSnapshotQuotaReserved"
>     }
>     value {
>       type: 7
>       signedValue: 3690956898
>     }
>   }
>   recordField {
>     identifier {
>       name: "deviceName"
>     }
>     value {
>       type: 3
>       stringValue: "x's iPhone"
>     }
>   }
>   recordField {
>     identifier {
>       name: "lastGMSnapshot"
>     }
>     value {
>       type: 5
>       referenceValue {
>         type: 2
>         recordIdentifier {
>           value {
>             name: "S:x"
>             type: 1
>           }
>           zoneIdentifier {
>             value {
>               name: "mbksync"
>               type: 6
>             }
>             ownerIdentifier {
>               name: "x"
>               type: 7
>             }
>           }
>         }
>       }
>     }
>   }
>   recordField {
>     identifier {
>       name: "marketingName"
>     }
>     value {
>       type: 3
>       stringValue: "iPhone 5"
>     }
>   }
>   recordField {
>     identifier {
>       name: "snapshots"
>     }
>     value {
>       type: 16
>     }
>   }
>   recordField {
>     identifier {
>       name: "deviceColor"
>     }
>     value {
>       type: 3
>       stringValue: "#3b3b3c"
>     }
>   }
>   recordField {
>     identifier {
>       name: "currentKeybagUUID"
>     }
>     value {
>       type: 3
>       stringValue: "x"
>     }
>   }
>   recordField {
>     identifier {
>       name: "deviceClass"
>     }
>     value {
>       type: 3
>       stringValue: "iPhone"
>     }
>   }
>   recordField {
>     identifier {
>       name: "pendingSnapshotID"
>     }
>     value {
>       type: 3
>       stringValue: "S:x"
>     }
>   }
>   recordField {
>     identifier {
>       name: "deviceEnclosureColor"
>     }
>     value {
>       type: 3
>       stringValue: "#99989b"
>     }
>   }
>   recordField {
>     identifier {
>       name: "productType"
>     }
>     value {
>       type: 3
>       stringValue: "iPhone5,2"
>     }
>   }
>   modifiedBy {
>     name: "x"
>     type: 7
>   }
>   modifiedByDevice: "x iPhone"
>   permission: 2
> }
> clientVersionETagMatch: false
> ]

is that ok ?

[horrorho]

Excellent, thank you. Ok ok!

>   recordField {
>     identifier {
>       name: "pendingSnapshotQuotaReserved"
>     }
>     value {
>       type: 7
>       signedValue: 3690956898
>     }
>   }

As you reported there is around 3GB of data in there, but it's pending. The snapshot never completed. As far as I'm aware there is no way to recover a partially completed snapshot.

Again there are no completed snapshots:

>   recordField {
>     identifier {
>       name: "snapshots"
>     }
>     value {
>       type: 16
>     }
>   }

Contrast this with my housemate's backup:

recordField {
    identifier {
      name: "snapshots"
    }
    value {
      type: 13
      recordFieldValue {
        type: 5
        referenceValue {
          type: 2
          recordIdentifier {
            value {
              name: "S:xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
              type: 1
            }

So in conclusion it's a partially completed backup. Again, as far as I'm aware, you cannot recover this but please feel free to try other tools. Elcomsoft amongst others do trial versions which often tell you what backups you have available.

Again thank you for your ticket and assistance, I'm sorry I couldn't help you any further.

[athegs]

Ok Thank you for your time :) i have already use elcomsoft i got same result no device and snapshot