manifest.db is an SQLite database that contains a list of all the files and folders extracted from the iPhone via the backup mechanism. The Files table of the database includes the following columns:

• fileID: This is a Secure Hash Algorithm 1 (SHA1) hash of the domain, plus the - symbol and file or folder relative path. For example, ae94e0607ca39a88c18aca095cb5b4f8471291a0 is the SHA1 hash for CameraRollDomain-Media/PhotoData/Thumbnails/V2/DCIM/102APPLE.
• domain: This is the domain to which the file or folder belongs (all files in iOS are divided into multiple domains—for example, CameraRollDomain and HomeDomain).
• relativePath: This is the relative path to the file (including the filename) or folder.
• flags: These are the file flags.
• file: This is an embedded .plist file. These .plist files include the following important pieces of information, among others:
  • LastModified: This is the file's last modification timestamp in Unix format.
  • Birth: This is the file creation timestamp in Unix format. The fields are shown in the following screenshot:

You can easily export this .plist embedded binary using, for example, DB Browser for SQLite (DB4S). To do this, observe the following steps:

1. Open manifest.db using the Open Database button.
2. Go to the Browse Data tab.
3. Click on a cell from in the file column.
4. On the Edit Database Cell pane, use the Export button to save the data as a .plist file, as illustrated in the following screenshot:

Since iOS 10, files are no longer named with 40-character hexadecimal strings. Instead, you will see a list of folders named with 2-character hexadecimal strings, which contain the files you used to see in previous versions, as illustrated in the following screenshot:

Now that you understand the backup structure, let's learn how to extract valuable data from it.