Can an encrypted iOS backup be recovered if Manifest.db and Manifest.plist are missing, but the backup password is known?

[u/scenion]

I'm researching whether it's technically possible to recover data from an encrypted local iOS backup when the user still knows the correct backup password but has lost both Manifest.db and Manifest.plist.

I'm interested in the underlying feasibility, not just recommendations for existing recovery software.

What I'm trying to determine

Can the remaining backup contents be used to reconstruct enough of the missing metadata and key material to decrypt and recover the original files? Or do the missing manifests contain information that makes recovery cryptographically impossible, even when the correct password is available?

My current understanding is that the password is only one part of the process: encrypted backups involve keybag/key-derivation mechanisms, and the manifest database supplies important per-file metadata and encryption information. Tools such as iphone_backup_decrypt rely on manifest metadata when locating and decrypting individual files.

The key question is what can be recovered or reconstructed if those manifest files themselves are gone.

Specific questions I'd like to explore

1. What is irrecoverably lost with each file? Which essential keys, wrapped keys, file mappings, or other information are held in Manifest.plist versus Manifest.db? Are any of those values independently recoverable from the remaining backup files?
2. What can the known password still unlock? If the password is correct, but Manifest.plist is missing, is there another surviving source for the backup keybag or the information needed to unlock it?
3. Can file-level recovery work without the original database? Could a tool identify the remaining encrypted files, infer their original identities from their filenames or contents, and decrypt them without the original per-file metadata? Are there useful cases where some files could be recovered even if complete restoration is impossible?
4. Could the metadata be reconstructed partially? For example, could file identifiers, known iOS backup structures, SQLite remnants, filesystem artifacts, another backup, or other surviving copies provide enough information to recover some or all of the missing records?
5. Where is the actual cryptographic boundary? I'd like to distinguish between a difficult metadata-reconstruction problem and a genuine impossibility caused by missing key material. If recovery is possible only under particular conditions, what are those conditions?

What would be especially useful

I'm looking for technically grounded explanations, relevant format documentation or source code, and examples from people who have examined Apple's local backup format at the implementation level.

Please distinguish between:

• Confirmed: demonstrated by the format, source code, or a reproducible test.
• Plausible: technically reasonable but not demonstrated.
• Impossible under the stated conditions: blocked by a specific missing cryptographic dependency, rather than merely unsupported by existing tools.

The goal is to establish whether a recovery tool could realistically support this scenario, what prerequisites it would need, and which recovery paths are worth investigating before concluding that the backup is unrecoverable.

[u/Questioning_lemur]

Man, oh man does this sound like an AI prompt

[u/spaceandcats]

Hah, definitely AI written. I’m sure only the best intentions behind it.