Most clients cannot hand you an unlocked phone and a week. Many can hand you a backup. An iOS backup is the copy a phone writes to a computer, and it is often the first piece of evidence a client can actually produce. It is also easy to underrate. Here is what SectraTEK reads in an iOS backup, what a backup is too small to show, and how the examination ends in a report that says so.
What an iOS backup is, and how it is obtained
An iOS backup is a folder of data that an iPhone or iPad copies to a computer: the device’s apps and their data, settings, and details about the device itself. The owner can make it with their own computer, or an examiner can make it from a phone in front of them. The phone stays in its owner’s hands, and nothing needs to leave the building but a folder.
SectraTEK examines that folder where it is stored. It is read-only and is not copied into the product. A SHA-256 hash of the evidence is recorded in the case before analysis starts, and a final check near the end confirms the evidence still matches. If the source changes after it was added, the examination is refused rather than quietly continued.
The device name, model and operating system version come from the backup itself, and everything downstream uses that same identity, so exposure is assessed on device evidence rather than on what someone typed into a form.
What the evidence shows, and what it cannot
A backup is a selection, not an image. It captures what the phone chose to copy. It does not capture everything the phone knows, and the gap is the difference between a backup and a full file system.
Whether the backup was encrypted when it was made matters a great deal. An unencrypted backup does not contain saved passwords, Wi-Fi settings, call and website history or Health data. An encrypted backup carries more of that history. Where you can, collect an encrypted backup. SectraTEK reports whether the backup was encrypted, and it reports the device’s Lockdown Mode state where the evidence records it, so the report can tell the reader why some records are missing rather than leaving them to guess.
The same honesty applies to the checks themselves. Findings focus on the software people install and configure, which keeps the list on what matters. Where an iOS backup holds less than a full file system, SectraTEK marks the checks it could not evaluate. A check that was marked not evaluated is never reported as none found.
Finally, the usual limit applies to every device examination. Zero-day and memory-corruption attacks can leave few lasting traces, and a result with no findings is not proof that a device was never attacked.
A backup records the version of iOS the phone was running, and the version is the key to the question of what the phone is exposed to. The volume of that question is large: the National Vulnerability Database published 652 CVE records matching iPhone OS from January 1 to October 20, 2026[S1]. These are published vulnerabilities, not exploited ones, and the count depends on how the database tags products.
SectraTEK compares the recovered version with vendor security releases, keeps exposure and known exploitation apart, and a backup carries enough to do it.
Describe this figure
Schematic. On the left, what an iOS backup holds: installed apps and where they came from, privacy permissions, configuration and device details, documents and attachments, and, only if the backup was encrypted, saved passwords and website and call history. Full-filesystem records are not present. On the right, the seven engines that read it.
What we look for
When the Lab examines a backup, we start with the apps and the configuration, because that is what a backup holds most completely.
Apps and how they got there. SectraTEK brings each app together with the sensitive capabilities it can reach, and shows how the app was installed where the device recorded it. Each app gets a Low, Medium or High review priority that tells you where to look first. Priority follows the access an app can reach, never its name or popularity.
Permissions, including camera and microphone. Every permission record is tied to its app, so each app’s access is shown as the evidence recorded it, with its recorded state. That tells you what an app was able to reach, which is a different thing from what it did. A report that blurs the two is not defensible, and ours keeps them apart.
Known-bad indicators. What the backup contains, such as apps, certificates, files, domains and addresses, is compared with SectraTEK Intelligence, and every exact match is reported with its family and context. Where the backup contains the sites a device visited, SectraTEK compares them with its intelligence as well, and states the period they cover.
Documents and attachments. SectraTEK lists the documents and message attachments recorded in the backup, with their types and the conversation they belong to. It does not open or analyze what a document says. A file the backup does not hold cannot be listed, and the report says what was and was not present.
Configuration and posture. SectraTEK reconstructs the recoverable security and privacy configuration: screen lock, updates, privacy settings and installed configuration profiles. Only settings the evidence establishes are assessed, and controls the evidence cannot establish are left out of the score. For iOS, Lockdown Mode, backup encryption and the number of trusted computers are reported as posture facts beside it.
Vulnerability exposure. The recovered operating system and app versions are compared with vendor security releases and known-exploitation context. Technical exposure and known exploitation are shown separately.
Findings, leads and the owner’s own identifiers. Findings review the apps and settings that deserve attention and combine the signals into something you can act on, with the reasons behind each. Insight ranks leads, which stay starting points for corroboration. If the engagement calls for it, an OSINT check can look at the device owner’s own identifiers, such as the set-up account, in an authorized examination. It runs only when you start it, and account presence and breach exposure are always reported separately.
Seven of the eight engines read an iOS backup. The eighth, mobile traffic analysis, belongs to network captures.
Our approach
How SectraTEK approaches this
The Lab’s approach to a backup is the approach to every evidence type, tuned for the one thing a backup always is: incomplete. So we make the incompleteness a feature of the report rather than a footnote to it.
The examination makes no outside contact, which keeps results reproducible. Each check reports whether it had the evidence to run, so you know exactly what was covered. Findings stay focused: ordinary activity is not raised, and what is raised comes with its reasons. Anything that cannot be decided is reported as such, never as clean. SectraTEK reports what it compared and what matched, and the examiner draws the conclusion, confirming, rejecting, or marking a finding as needing corroboration or likely benign.
Describe this figure
Flow in four steps: the backup folder is referenced in place and hashed; seven engines read it and checks that need a full file system are marked not evaluated; results are rated Critical, High, Moderate, Low or No match; the AI-Dossier carries the findings, leads, intelligence matches, limits and the integrity record.
From findings to a report you can act on
The AI-Dossier carries the whole examination to the AI tool you choose: the findings with the examiner’s dispositions, Insight leads, threat intelligence matches, exposure and security configuration results, permission correlation, the processing record and the evidence integrity history. Evidence references stay with the AI-Dossier: every file in it is listed with its hash, and its instructions ask the report to tie each material statement to the records behind it. The AI-Dossier opens with a readable cover that names the evidence examined, what it can and cannot establish and the key figures of the case.
Ratings are words, so a page reads the same without color: Critical, the strongest evidence, where you start; High, strong evidence worth immediate review; Moderate, a signal worth a second look; Low, context or ordinary activity, noted for completeness; and No match, a neutral result shown with the coverage behind it. Every result carries a clear severity, so the strongest evidence is at the top of your review.
The AI-Dossier asks for an executive report that a senior executive, general counsel or board member can read in minutes, with the technical depth placed behind it in appendices. For a backup, that usually produces three kinds of next step. Fix what is exposed: update the operating system, review an app that holds access it does not need, remove a configuration profile nobody can explain. Corroborate what is open: a lead that stays a lead after review earns a fuller look. And, where the report lists checks it could not evaluate, say whether a full-filesystem examination would close the gap. That last sentence is how a report built on a backup stays defensible: it shows the client where the evidence ends.
Who it is for, and how it fits
A backup examination suits the labs and consultancies that run device checks for their own customers, and corporate security teams that need a more thorough check than an on-device scan can give without the cost of a comprehensive examination. It is the practical choice when the phone cannot be taken, when the client needs the device back quickly, or when a first answer is needed before deciding whether to go deeper.
It sits between a sysdiagnose and a full file system. A sysdiagnose tells you how the phone ran; a backup tells you what the phone held and how it was set up; a full-filesystem examination holds the most. The same engines run on the same intelligence in SectraTEK Full and SectraTEK Lite, and the difference is the workspace around them: Lite keeps the results. Full keeps the case.
As always, no findings means no known indicators were found in the evidence provided. For a backup, the AI-Dossier says what that evidence was, and what it was not.
Sources
Facts about third parties are attributed to the publisher named in the sentence. Each marker such as [S1] opens its row here.
| Marker | Publisher and title | Published | Accessed | Address |
|---|---|---|---|---|
| [S1] | NIST (National Vulnerability Database) National Vulnerability Database: CVE records matching Apple iPhone OS, counted October 21, 2026 | nvd.nist.gov |
The sources were last read on . If a fact here changes, the correction carries its date.