Apple Juicer

Turn an iOS backup into browsable forensic artifacts.

Point Apple Juicer at a folder of Finder/iTunes backups. It discovers them, decrypts the encrypted ones in the background, indexes ten artifact types into a database, and gives you a web UI to browse conversations, photos, call history, locations and more, search across all of them at once, and export what you find.

Personal-use software, not safe to expose to the public internet

Apple Juicer is built for one investigator running it on their own machine, not as a hardened multi-user service. Run it on a trusted LAN, a single-user workstation, or behind a VPN / authenticating reverse proxy — never bound directly to a public IP.

Authentication is a single static API token with no rotation, rate limiting, or lockout. Decrypted backups are written to disk in plaintext. The unlock passphrase travels to the worker as a job argument. These are deliberate trade-offs for a local tool; the Security page lists every one of them and how to compensate if you need to.

What it pulls out of a backup

Apple Juicer indexes ten artifact types, each with its own browsable view:

Artifact	Source	What you get
WhatsApp	ChatStorage.sqlite	Chats, messages, attachments
Messages	chat.db	iMessage and SMS conversations
Photos	Photos.sqlite	Photo timeline with thumbnails and full-size view
Notes	NoteStore.sqlite	Note bodies and folders
Calendar	Calendar.sqlitedb	Events and calendars
Contacts	AddressBook.sqlitedb	Address book entries
Calls	CallHistory.storedata	Call log
Safari	History.db	Browsing history
Locations	routined caches	Significant locations
Voicemail	voicemail.db	Voicemail messages

On top of the per-artifact views, five features cut across all of them:

• People. A contact-centric view that collapses one person’s WhatsApp messages, iMessages, calls, and voicemails into a single entity, with the name resolved from Contacts. It answers who, where search answers what and the timeline answers when.
• Map. Significant locations and geotagged photos plotted on a Leaflet map — it answers where.
• Global search. One query runs against every indexed type, and a hit links straight back to the conversation or record it came from.
• Unified timeline. Messages, photos, calls and the rest merge into a single reverse-chronological stream.
• Export. Download any tabular view as CSV, or generate a one-page PDF summary of the whole backup.

Quick start

git clone https://github.com/giovi321/apple-juicer.git
cd apple-juicer
docker compose up -d

Open http://localhost:5173, paste the API token (dev-token by default), and refresh to discover the backups under your mounted directory. See Quick Start for the full walkthrough.

How it fits together

Apple Juicer runs as five services behind Docker Compose: a FastAPI backend, an RQ worker for the slow parsing jobs, PostgreSQL for the indexed data, Redis for the job queue, and a React frontend served by nginx. The backend stays responsive while the worker chews through a backup in the background, and the original backups stay on disk, mounted read-only.

See the Architecture Overview for the full picture.

Tech stack

Component	Technology
Backend	Python 3.12 + FastAPI + async SQLAlchemy
Worker	RQ (Redis Queue)
Frontend	React 19 + TypeScript + Vite 7
Database	PostgreSQL 16 (SQLite for tests and local runs)
Queue	Redis 7
Decryption	iphone-backup-decrypt
Deployment	Docker Compose