manifest.db is an SQLite database that contains a list of all the files and folders extracted from the iPhone via the backup mechanism. The Files table of the database includes the following columns:
- fileID: This is a Secure Hash Algorithm 1 (SHA1) hash of the domain, plus the - symbol and file or folder relative path. For example, ae94e0607ca39a88c18aca095cb5b4f8471291a0 is the SHA1 hash for CameraRollDomain-Media/PhotoData/Thumbnails/V2/DCIM/102APPLE.
- domain: This is the domain to which the file or folder belongs (all files in iOS are divided into multiple domains—for example, CameraRollDomain and HomeDomain).
- relativePath: This is the relative path to the file (including the filename) or folder.
- flags: These are the file flags.
- file: This is an embedded .plist file. These .plist files include the following important pieces of information, among others:
- LastModified: This is the file's last modification timestamp in Unix format.
- Birth: This is the file creation timestamp in Unix format. The fields are shown in the following screenshot:
The manifest.db contents
You can easily export this .plist embedded binary using, for example, DB Browser for SQLite (DB4S). To do this, observe the following steps:
- Open manifest.db using the Open Database button.
- Go to the Browse Data tab.
- Click on a cell from in the file column.
- On the Edit Database Cell pane, use the Export button to save the data as a .plist file, as illustrated in the following screenshot:
Exporting an embedded .plist file with DB4S
Since iOS 10, files are no longer named with 40-character hexadecimal strings. Instead, you will see a list of folders named with 2-character hexadecimal strings, which contain the files you used to see in previous versions, as illustrated in the following screenshot:
iPhone backup files
Now that you understand the backup structure, let's learn how to extract valuable data from it.