Manifest.mbdb and Manifest.mbdx are the two files in the iPhone backup directory which provide information and data about all the other files, along with filesystem structure data.
The MBDX file is the index file of the backup, and indexes elements that will be found in Manifest.mbdb. It is made of a fixed length header and a number of fixed length records, one for each element to be listed.
uint8 containing the string “mbdx\2”.
uint32 containing the number of following records.
uint8 key of the referenced element, which is also the name of the element as saved in the backup directory.
uint32 offset of the corresponding record in Manifest.mbdb file. The offset doesn’t count the Manifest.mbdb header (6 bytes), so the absolute offset is calculated by adding 6 to the value read in the field.
uint16 file mode.
The file mode is a 16 bits value (from 15 to 0) whose fields contain:
bits 15 to 12 identify the file type: “A” for a symbolic link, “4” for a directory or “8” for a regular file.
bits 11 to 8 permissions for the file owner to read (bit 10), write (bit 9) and execute (bit 8) the element.
bits 7 to 4 permissions for the users in the file group to read (bit 6), write (bit 5) and execute (bit 4) the element.
bits 3 to 0 permissions for all the other users to read (bit 2), write (bit 1) and execute (bit 0) the element.
Con iTunes 9.2 è cambiato il file Manifest.plist, sono stati rimossi i file .mdinfo, e l’ estensione .mddata non viene più usata; comunque la chiave a 40 digit è la stessa.
Ora il database dei file è contenuto in due file: Manifest.mbdb e Manifest.mbdx. La lista delle applicazioni rimane in Manifest.plist, ma il formato è leggermente cambiato.
Importante : tutti i numeri sono big endian.
E’ il file indice.
uint8 'mbdx\2\0' uint32 record count in the file
record (fixed size of 26 bytes)
uint8 the Key of the file, it's also the filename in the backup directory It's the same key as 9.1 backups. uint32 offset of file record in .mbdb file Offsets are counted from the 7th byte. So you have to add 6 to this number to get the absolute position in the file. uint16 file mode Axxx symbolic link 4xxx directory 8xxx regular file The meaning of xxx is unknown to me, it corresponds to the Mode field in the old backup data.
record (variable size)
string Domain string Path string LinkTarget absolute path string DataHash SHA.1 (some files only) string unknown always N/A uint16 Mode same as mbdx.Mode uint32 unknown always 0 uint32 unknown uint32 UserId uint32 GroupId mostly 501 for apps uint32 Time1 relative to unix epoch (e.g time_t) uint32 Time2 Time1 or Time2 is the former ModificationTime uint32 Time3 uint64 FileLength always 0 for link or directory uint8 Flag 0 if special (link, directory), otherwise unknown uint8 PropertyCount number of properties following
Property is a couple of strings:
string name string value can be a string or a binary content
A string is composed of a uint16 that contains the length in bytes or 0xFFFF (for null or N/A) then the characters, in UTF-8 with canonical decomposition (Unicode normalization form D).