We searched a real iPhone backup for our own messages.

What we did

1. On one iPhone, we sent and received the same test phrase in a WhatsApp chat and in an OUT chat. In OUT we also sent a photo.
2. We closed OUT and connected the iPhone to a Mac. In Finder we made a full local backup: plain (no password) the first time, encrypted the second time, with a new test phrase.
3. For the plain backup, we listed every file each app put into it and searched all 19.4 GB for the test phrase, as UTF-8 and as UTF-16, ignoring upper and lower case.
4. For the encrypted backup, the phone’s owner entered the backup password on his own Mac. A script decrypted each of the 22,351 files in memory, one at a time, and searched it the same way. Only the locations of matches were written down, never their content.

Test phrases: “OUT FORENSIC” in the plain backup, “OUT KEY TEST” in the encrypted one. Using a new phrase for the second test means no result can come from the first.

$ python out_scan.py
Backup password (not shown):
Password OK. Scanning every file in the backup...
  2000/22351 files, 0.2 GB
  ...
  20000/22351 files, 19.2 GB
  22000/22351 files, 19.3 GB
Done in 85 s. Files scanned: 22351, errors: 0.
Matches: 9. OUT files: 1.

Results

What WhatsApp left

WhatsApp, like most messengers, writes every message into a database on the phone, and that database is part of the backup. In the plain backup it could be opened directly, without any password. These are the test messages from the encrypted backup, exactly as stored once it is decrypted (times in UTC):

The same words were also in WhatsApp’s search index, a second copy that exists so you can search your chats. Encrypting the backup did not change any of this: anyone with the backup password reads it all.

What OUT left

In both backups, OUT contributed exactly one file: Library/Preferences/com.outmessenger.app.plist, 196 bytes. This is its entire content:

out.chatsView              galaxy
out.appearance             dark
out.interfaceSounds        true
out.signedOut              false
out.acceptedTermsVersion   2
out.installMarker          1

No messages, no photo, no contacts, no usernames, no message times. That is by design: OUT keeps message content in memory and never writes it to a chat database, so there is nothing for a backup to copy.

What iOS records anyway

We also looked for every file in the backup that mentions OUT by name. These traces are written by iOS itself, not by OUT, and they are the same for any app:

• That OUT is installed: home screen layout, the Spotlight app list, notification settings.
• Permissions: camera and microphone allowed.
• Network use: iOS keeps a first-seen and last-seen time for each app that uses the network.

None of them contained message text, contacts or names.

Keys and the Keychain

An encrypted backup also contains the iPhone’s Keychain, where apps keep passwords and keys. This backup held 1,986 Keychain items. 561 of them are marked ThisDeviceOnly: they are locked to the hardware of that one iPhone and cannot be opened anywhere else, even with the backup password.

OUT stores its keys only in ThisDeviceOnly items. Which app owns each Keychain item cannot be seen from the backup, because that information is encrypted too.

Beyond a backup: where this test sits

Forensic examiners choose between several kinds of extraction. Each one reaches deeper into the phone than the one before. A backup is the shallowest kind, and it is the one we tested.

Some of the places examiners rely on most are only reached by the deeper extractions. We checked our plain backup: none of the first three below were in it. This is what OUT puts in each of them, by design and checked in our source code before every release:

Some apps encrypt their own databases. A deeper extraction usually includes the Keychain where those database keys are kept, so the messages can still be read. OUT does not depend on that: there is no message database to decrypt in the first place.

Extraction types and file locations follow published 2026 guidance for iOS forensic examiners. Whether each location was present is from the backups in this test.

Technical details

Backup format. A Finder backup stores every file under a SHA-1 name in 256 folders. Manifest.db, an SQLite database, maps each one back to its app domain and original path. That is how each finding below is tied to an app.

Encryption. In an encrypted backup every file has its own AES-256 key. Those keys are wrapped by data-protection class keys, kept in a keybag that only the backup password unlocks (PBKDF2). Keychain items of the ThisDeviceOnly classes are wrapped with a key bound to the iPhone’s hardware instead, so the password alone does not open them.

Search. Every file was read in full and searched, ignoring case, for the test phrase as UTF-8 and as UTF-16LE. Files were decrypted in 8 MB blocks with an overlap, so a phrase split across two blocks is still found. Only the location of a match was recorded, never the surrounding data.

Validation. We checked the results at their source rather than trusting one program’s summary: the WhatsApp rows were read directly from the database and their times decoded by hand from Apple’s clock (seconds since 1 January 2001, UTC). The test was run twice, independently: a raw byte search of a plain backup and a decrypt-and-search of an encrypted one, each with its own test phrase. A cross-check with a second, independent forensic tool is still to come.

What this test does not prove

• It is a backup test, not a full extraction. Commercial forensic tools, such as Cellebrite or Magnet AXIOM, can sometimes copy more of a phone than a backup contains. We have not yet tested OUT with one.
• One iPhone, one iOS version (iOS 18.7.10), on one day.
• A message on screen can be photographed. If a phone is taken unlocked with a chat open, what is visible can be seen.
• No app can control the other person’s phone or what iOS itself records about app use.

We will publish further tests here as we run them.

Repeat it yourself

1. Send a unique phrase in the app you want to test, and receive one.
2. Back up the iPhone in Finder (Mac) or the Apple Devices app (Windows). Try it with and without “Encrypt local backup”.
3. Search the backup for your phrase. For an encrypted backup, the open-source iphone_backup_decrypt library can decrypt it on your own computer.

We are happy to share the exact scripts we used. Write to info@outmessenger.com.

Questions about iPhone backups and messengers