What is in an iPhone backup, and where forgotten copies live

When you delete a sensitive photo from your iPhone and empty Recently Deleted, it is easy to assume that photo is gone everywhere. Often it is still sitting in two quiet places nobody checks: a nightly iCloud Backup from an old iPad, or an unencrypted Finder / iTunes backup folder on a laptop you plugged into two summers ago before a software update.

Understanding what Apple actually packs inside an iPhone backup, and how one toggle flips photo backups on and off, lets you find every lingering copy.

What goes into an iCloud backup vs a Mac or PC backup

Apple documents both backup types in What does iCloud back up? (108770) and Backup methods for iPhone or iPad (108771). Both follow one core rule: a device backup captures data stored locally on the phone that is not already synced separately to iCloud.

The forgotten backup trap: old laptops and retired phones

Two backup scenarios catch privacy-conscious people off guard more than any other:

1. Unencrypted Mac or Windows backups: when you plug an iPhone into a Mac (Finder) or Windows PC (Apple Devices / iTunes) and click Back Up Now without ticking Encrypt local backup, macOS/Windows writes thousands of files into a local MobileSync/Backup/ directory on that computer’s drive. Anyone with access to that computer user account can open those backup files with free desktop extractor apps and browse every local photo, including items inside Apple’s Hidden album, without knowing your iPhone passcode or Face ID.
2. Retired iPhones and iPads in iCloud Backup: if you upgraded phones last year, your old phone’s final iCloud Backup snapshot often remains stored in your iCloud account for months (until iCloud purges inactive device backups after 180 days without backing up, or longer if the old phone still sits plugged into a drawer on Wi-⁠Fi!).

How to find and delete old iPhone backups

Check all three locations below to see every backup snapshot tied to your phones and computers:

1. On your iPhone, open Settings, tap your name at the top, tap iCloud, and tap iCloud Backup to see every device currently backed up to your account; tap any old device you no longer need and choose Turn Off and Delete from iCloud.
2. Inside that same iCloud Backup screen, tap your current iPhone to see the exact list of apps included in your nightly backup and switch off any app whose local files should never go to iCloud.
3. On a Mac, connect your iPhone or open Finder, click Manage Backups, or press Command + Shift + G in Finder and go to ~/Library/Application Support/MobileSync/Backup/ to see every local backup folder on that Mac, then delete old unencrypted snapshots and enable Encrypt local backup for future ones.
4. On a Windows PC, open the Apple Devices app (or iTunes > Edit > Preferences > Devices) or check %APPDATA%\Apple Computer\MobileSync\Backup\ and %USERPROFILE%\Apple\MobileSync\Backup\ for old local backup folders.

Who holds the encryption keys to your iPhone backup?

• iCloud Backup under Standard data protection (default): encrypted on Apple’s servers, and Apple holds the decryption keys so it can help you recover your account or respond to valid legal requests.
• iCloud Backup with Advanced Data Protection turned on: end-⁠to-⁠end encrypted using keys held only on your trusted devices. Apple cannot decrypt your iCloud Backup.
• Encrypted local Mac/PC backup: encrypted on your computer using PBKDF2/AES derived from the backup password you choose in Finder or Apple Devices. Choose a long passphrase, not a 4-⁠digit PIN, because anyone who copies that backup folder can test passwords offline on GPUs. Test your passphrase strength first in our unlock strength calculator.