MOBILE FORENSICS

iCloud forensics and Apple cloud data

Nowadays, much of the information on an iPhone is not stored exclusively locally, but is synchronised or backed up via iCloud. Depending on the configuration, backups, photos, contacts, calendars, notes and other data may be stored in the Apple cloud. iCloud forensics examines these data sources within the limits of what is technically and legally possible.

iCloud backups
iCloud Drive
Photos
Contacts
Calendar
Notes
Safari data
iCloud Keychain (restricted access)
App-specific synchronisation data

TECHNICAL BACKGROUND

Technical Fundamentals

iCloud comprises various services that synchronise or back up data between Apple devices. These include, amongst others:

  • •iCloud backups
  • •iCloud Drive
  • •Photos
  • •Contacts
  • •Calendar
  • •Notes
  • •Safari data
  • •iCloud Keychain (restricted access)
  • •App-specific synchronisation data

The information available depends on the services that have been activated, the access options and the specific enquiry.

OUR APPROACH

This is how your examination will be carried out

A transparent process – from the initial enquiry to the handover of the report.

1
The process begins by identifying which data sources are available for the investigation. Suitable forensic tools are then used to analyse the available cloud data in a structured manner. The results are cross-referenced with local artefacts and assessed within the overall context. All stages of the investigation are documented in a manner that ensures full traceability.
2
LanCologne produces expert reports for private individuals, as well as for companies and solicitors. Our reports have already been used in court proceedings. In some cases, we have been directly commissioned to produce IT forensic reports. Upon request, we can provide anonymised or redacted sample reports or extracts.

TYPICAL QUESTIONS

When is this analysis required?

  • ✔What data is stored in iCloud?
  • ✔Can an iCloud backup be examined?
  • ✔What are the differences between local and cloud data?
  • ✔What synchronisation artefacts are present?
  • ✔What are the technical limitations?

LIMITATIONS & CONCLUSION

What you should know

The scope of an iCloud investigation depends, amongst other things, on the available login details, the iCloud services that have been activated, the data stored by Apple, and the technical conditions. Not all data is available at all times or stored permanently.

iCloud forensics complements the standard examination of an iPhone and, depending on the individual case, provides additional insights from synchronised or backed-up cloud data.

CUSTOMER REVIEWS

What our customers say

4.8 out of 5 stars on Trustpilot · 54 reviews

★★★★★

“The highest standards of professionalism, prompt service and excellent communication. They made the seemingly impossible a reality. This is what genuine customer service is all about – unrivalled in Germany!”

idalein

Verified review on Trustpilot

★★★★★

“Very helpful advice, excellent responsiveness and communication. My problem was completely resolved and the lost data was recovered. I’m very satisfied and, of course, relieved!”

Layla Pankratz

Verified review on Trustpilot

★★★★★

“My problem was sorted out professionally and quickly; everyone I spoke to was always friendly, and I can still get in touch if I have any questions – I’m very grateful for that!”

a woman from Cologne

Verified review on Trustpilot

Enquire now – free initial consultation

Do you need a professional examination of iCloud data or an Apple backup? LanCologne can assist you with an objective IT forensic analysis and comprehensive expert documentation.

RELATED TOPICS

You might also be interested in

FREQUENTLY ASKED QUESTIONS

Frequently Asked Questions

Click on a question to see the answer.

Can an iCloud backup be examined?
Yes, provided that the necessary conditions and authorisations are in place.
Is all iPhone data stored in iCloud?
No. This depends on the services that have been activated and the user’s settings.
Are cloud and device data compared with one another?
Yes, provided that this is appropriate for the question and technically feasible.
Can deleted cloud data be accessed?
That depends on the service in question and the data available.
Can an expert report be drawn up?
Yes, the findings can be documented in a comprehensive IT forensic report.