Forensic Analysis of iCloud Backups up to iOS15
With Magnet AXIOM, you can acquire and analyze iCloud backups up to and including iOS 15.
Gaining access to Apple user data for forensic examiners has been a challenge and the relationship between Apple and the law enforcement community could be described as ‘contentious’ to say the least — with Apple refusing to unlock iPhones even in high profile cases.
Regardless of Apple’s approach, law enforcement officers need tools to recover and analyze evidence of illicit activity.
With Magnet AXIOM, there is robust support for several legal avenues to support forensic examiners in their acquisition and analysis of Apple data. Support has been available for Apple Warrant Returns since AXIOM 3.5. Now, with AXIOM 5.9 examiners can acquire iCloud backups up to and including iOS 15 with user credentials.
With iCloud backups, you can potentially uncover data related to:
- App data
- Apple Watch backups
- Device settings
- Home screen and app organization
- iMessage, SMS, and MMS messages
- Photos and videos on your iPhone, iPad, and iPod touch2
- Purchase history from Apple services
- Ringtones
- Visual Voicemail password
Check out this how-to video with Kim Bradley here as she highlights what type of data you can examine in an iCloud backup:
Working to Continue Providing Support Indefinitely for iCloud Backups
Acquiring iCloud backups can be a significant challenge for digital forensic solution providers. Due to Apple’s data structure and their commitment to user privacy, Apple has actively worked to close third-party access to their data sources.
Support is available today and we will work to continue to provide support indefinitely. As Apple makes adjustments to their data structure and security protocols, service disruptions for the acquisition of iCloud backups are possible.
If you haven’t tried AXIOM or AXIOM Cyber yet, request a free trial here.