iCloud Backup Structure

Once iCloud backups are downloaded and processed, the following folders are created in the destination folder (iOS 9.x and higher):

.chunks

<device ID>

 [backup ID][YYYYMMDD_HHMMSSZ]

 ...

 [backup ID][YYYYMMDD_HHMMSSZ]

<device ID>

 ...

where the <device ID> is the unique ID of the device, and <backup ID> is the unique ID of a particular backup (usually as many as three latest backups are stored in the iCloud). [YYYYMMDD_HHMMSSZ] is the date and time when the backup was created.

The .chunks folder is actually the 'cache' of the (raw) data downloaded that allows saving time when/if you download backups for the same device again.

Please note that in backups for iOS 10 and higher, each file with an unrestored name is stored in a subfolder whose name is the first two letters of the file name. E.g., a full path to the file named "fd4056e1b33b" will be the following:

<backup_root>/fd/fd4056e1b33b

For iOS 8 and older versions, downloaded data has a different structure:

.chunks

<device id>

 .keys

 [01]

 ...

 [N]

 [N+1]

 [01][YYYYMMDD_HHMMSSZ]

 ...

 [N][YYYYMMDD_HHMMSSZ]

 [N+1][YYYYMMDD_HHMMSSZ]

The first three folders (with numbers used as names) are also the raw data as it is stored in the iCloud, partially converted (and already decrypted). Please note that iCloud backups are cumulative. In most cases, the first folder is the largest (and its total size is compared to the size of the device itself), the second one is much smaller, and the third one is the smallest.

The folders with the date/time in the names are 'complete' backups converted to the Apple iTunes format. Each of them has about the same size as the backup itself (as far as backups are usually created on a daily basis, the differences are rather small). If you used the Restore original file names (or Download only specific data) option, the folders with date/time will also have the [R] suffix at the end (and the size of each folder may be less than the backup size because not all the data is downloaded).

So the total size required for storing all backup(s) is usually five times more than the size of a single backup as shown on the device itself or by the program.

Whether or not you are using the Restore original file names option, it is recommended to download backups always to the same folder. Do not delete the .chunks folder -- downloading will be much faster.

Example:

Without the Restore original file names option:

.keys

1

19

20

[01][20131124_132403Z]

[19][20131126_130112Z]

[20][20131128_132645Z]

or with the Restore original file names option:

.keys

1

19

20

[01][20131124_132403Z][R]

[19][20131126_130112Z][R]

[20][20131128_132645Z][R]

Here you get three backups: created on 24/11/1013, 26/11/2013 and 28/11/2013. The latest backups are in the [20][20131128_132645Z] and [20][20131128_132645Z][R] folders respectively.

Full backup (in [20][20131128_132645Z]) contains a lot of files with names like 0ea4ce4cc6e4ce70e34584423b6cfdf6fe87fa, plus just four files with readable names:

Info.plist

Manifest.mbdb

Manifest.plist

Status.plist

This is a complete backup in iTunes format. To view the content, we recommend using Elcomsoft Phone Viewer.

Converted backups look better, preserving the complete folder structure, as well as the file names as stored in the iOS file system. Most data is stored is SQLite databases (.db and .sqlite) and .plist files; you also get pictures in PNG and JPEG, etc.