28 August 2026 · Day 8 · Giordano Sconti

Closing the loop: an iTunes-shaped backup on disk

Decrypting MMCS assets is not the same as having a backup a forensic workstation can open. On 28 August 2026 the work shifted from edge crypto to layout: write files the way a local iTunes / Finder backup expects them, so downstream tools see Backup/, hashed file IDs, and a real Manifest.db.

The download loop became domain-centric: for each Domain / fileList, authorizeGet and decrypt the listed assets, then place plaintext under Backup/xx/<fileID> while updating SQLite rows. Manifest material itself arrives as MMCS objects (MA: records); after decrypt you want SQLite magic, not a leftover ciphertext stub. Sidecars (Info.plist, Status.plist, Manifest.plist) finish the illusion of a device backup folder that other suites already know how to parse.

Parallelism here is careful: several Domains can run, but each keeps its own MMCS session shard so FileGroup caches do not cross-contaminate—the summer’s lesson applied to the filesystem stage.

In the code today

BackupFilesystemWriter.cs

/// Writes files as Backup/xx/fileID and updates Manifest.db (iTunes-style).
public sealed class BackupFilesystemWriter : IAsyncDisposable
{
    public static async Task<BackupFilesystemWriter> OpenAsync(
        string snapshotDirectory, CancellationToken ct = default)
    {
        var dbPath = Path.Combine(snapshotDirectory, "Manifest.db");
        // CREATE TABLE ... Files / Properties (SQLite)
    }
}

BackupDownloadService.cs

// per Domain -> FL download/decrypt -> Assets -> next Domain
// skeleton Manifest.db -> Backup/
// sidecar: Info.plist + Status.plist + Manifest.plist
await ItunesBackupSidecarWriter.WriteAsync(...);

← All notes