Writeup by n0tpresl3y for iForensics - iDevice

forensics iOS

November 30, 2025

1 — Extract the backup archive

We are provided with:

backup.tar.xz

Begin by extracting the archive:

tar -xf backup.tar.xz

Once decompressed, we browse through the extracted directory structure.


2 — Searching for system information

We are looking for Build Version and Model Identifier.

To search efficiently, we can use grep:

grep -r "Build Version" 

This reveals a relevant entry inside an Info.plist file.

Opening the file, we locate the values required for the flag:

<key>Build Version</key>
<string>20A362</string>
.
.
.
<key>Product Type</key>
<string>iPhone12,3</string>

Flag

FCSC{iPhone12,3|20A362}