This talk is an introduction to iPhone backup forensics. Often overlooked in favour of a full physical acquisition, the iPhone backup includes a wealth of forensically significant data and is in some cases much easier to acquire. In this session attendees will get a broad overview of the topic, from the iPhone backup’s anatomy, through where to find artefacts of specific applications, to guidance on automated processing and retrieval of them using tools such as SQL queries and Python scripts.