Retrieving Data on the iCloud

More than 190 million Apple customers reportedly use iCloud on a regular basis - a fact that should make the service of particular interest to forensic investigators.

In a blog entry recently posted by forensic software manufacturer Elcomsoft, Vladimir Katalov explains that "information stored in the iCloud can be retrieved by anyone without having access to a physical device, provided that the original Apple ID and password are known." With the application of the Elcomsoft Phone Password Breaker (EPPB), investigators can access "backup copies of the phone's content via iCloud services."

One does not need physical access to the PC that contains the backup; and there is no need to actually have an iOS device in your hand in order to access the cloud data. "All that’s needed to access online backups stored in an iCloud are user’s Apple ID and password," states the EPPB product literature on Elcomsoft's website. "Data can be accessed without the consent of knowledge of an iPhone user, making Elcomsoft Phone Password Breaker an ideal solution for law enforcement and intelligence organizations."

You can read more about what you can and cannot recover from iCloud in Elcomsoft's two most recent blog posts, "iCloud backups inside out" and "iCloud: Making Users Spy on Themselves".

 
< Prev   Next >






Item of Interest

The language barrier between English-speaking investigators and Spanish-speaking witnesses is a growing problem. (Updated 28 February 2011)

Read more...