Backup analysis errors

[sr-murthy]

I'm using the iOS mvt check-backup command to analyse the decrypted backup of an iPhone 11 (running 14.7), using a STIX2 file also, but getting the following errors in the log relating to the Manifest.db. Can you please provide any guidance on why this might be the case?

If the database file is damaged that might indicate problems with the backup decryption or the backup itself (I used libimobiledevice to do the backup and backup decryption).

ERROR    [mvt.ios.modules.fs.net_datausage] Error in running extraction from module Datausage: database disk image is    
                  malformed                                                                                                       
                  Traceback (most recent call last):                                                                              
                    File "/usr/local/lib/python3.8/site-packages/mvt/common/module.py", line 135, in run_module                   
                      module.run()                                                                                                
                    File "/usr/local/lib/python3.8/site-packages/mvt/ios/modules/fs/net_datausage.py", line 29, in run            
                      self._extract_net_data()                                                                                    
                    File "/usr/local/lib/python3.8/site-packages/mvt/ios/modules/fs/net_base.py", line 20, in _extract_net_data   
                      cur.execute("""SELECT                                                                                       
                  sqlite3.DatabaseError: database disk image is malformed
...
ERROR    [mvt.ios.modules.fs.sms] Error in running extraction from module SMS: database disk image is malformed          
                  Traceback (most recent call last):                                                                              
                    File "/usr/local/lib/python3.8/site-packages/mvt/common/module.py", line 135, in run_module                   
                      module.run()                                                                                                
                    File "/usr/local/lib/python3.8/site-packages/mvt/ios/modules/fs/sms.py", line 57, in run                      
                      cur.execute("""                                                                                             
                  sqlite3.DatabaseError: database disk image is malformed
...
ERROR    [mvt.ios.modules.fs.sms_attachments] Error in running extraction from module SMSAttachments: database disk image
                  is malformed                                                                                                    
                  Traceback (most recent call last):                                                                              
                    File "/usr/local/lib/python3.8/site-packages/mvt/common/module.py", line 135, in run_module                   
                      module.run()                                                                                                
                    File "/usr/local/lib/python3.8/site-packages/mvt/ios/modules/fs/sms_attachments.py", line 45, in run          
                      cur.execute("""                                                                                             
                  sqlite3.DatabaseError: database disk image is malformed
...
ERROR    [mvt.ios.modules.fs.calls] Error in running extraction from module Calls: database disk image is malformed      
                  Traceback (most recent call last):                                                                              
                    File "/usr/local/lib/python3.8/site-packages/mvt/common/module.py", line 135, in run_module                   
                      module.run()                                                                                                
                    File "/usr/local/lib/python3.8/site-packages/mvt/ios/modules/fs/calls.py", line 41, in run                    
                      cur.execute("""                                                                                             
                  sqlite3.DatabaseError: database disk image is malformed 

[p00perama]

As what one of the co-authors of the guide stated in #97

incompatibility of libimobiledevice with the latest iOS versions.

so that may be one of the factors that rendered your decrypted backup corrupted

[sr-murthy]

OK, thanks. I did try it again after taking an unencrypted backup, and this time there were none of these "database disk image is malformed" errors. There were some errors, but they seem to relate to modules which have no database files, or which have been deleted some time ago, e.g. Whatsapp.