App data

Files inside an app container are protected on disk. Copying them off as raw bytes gives you ciphertext. This module decrypts an app’s own data so the files come out in a form you can actually open.

What comes out

• Images, audio and video the app downloaded or generated
• Databases — SQLite files and their journals
• Property lists and JSON — preferences, feature flags, cached responses
• Caches — including the ones that will not clear
• Whole directories, exported in one operation

When you need it

A cache that never clears. Users report stale content after a refresh. Reading the cache directory tells you whether the app wrote the new response and ignored it, or never wrote it.

A migration that went wrong. Pull the database before and after an upgrade and diff them.

A corrupt download. The bytes are either wrong on disk or wrong on the way in. Opening the file settles it in a minute.

Reproducing a user’s state. Export their container, load it into a build on your own device, and the bug that “only happens for that one account” reproduces on your desk.

How to do it

1. Connect and unlock the device.
2. Open the app browser and select the app.
3. Choose the directory — Documents, Library, or the whole container.
4. Export to a folder on your computer.

Large containers take a while; media-heavy apps can run to gigabytes.

Reading what you get

• SQLite opens in any SQLite browser. Take the -wal and -shm files with it, or you will be reading a stale snapshot.
• Binary plists need a plist reader; a text editor shows binary noise.
• Cache directories are usually opaque naming over ordinary files — sort by size and look at the largest few first.
• Keychain items are not in the container. They are in the keychain, and they do not come out this way.

Limits

• The device must be unlocked and trusted, and it must stay unlocked for the export: files in the stronger data-protection classes are not readable when the device locks.
• This reaches app containers, not the entire system. KeyMob does not defeat platform protections.
• No jailbreak is involved, and none is required.

This is somebody’s data

An app container is where a person’s messages, photos, locations and tokens live. Three rules, and the user agreement makes them binding:

1. Only on devices you own or are explicitly authorized to examine.
2. Take the narrowest export that answers the question, not the whole container out of habit.
3. Delete the export when the ticket closes. An exported container on a laptop is a data breach waiting for a stolen bag.

If the device belongs to a customer, tell them what you are exporting and why, before you do it.

Next steps

File manager · Backup and export · App management