Does the User Have an iCloud Account?

With Apple integrating numerous services between iOS and OS X devices, knowing that a user has an iCloud account can be invaluable in an investigation. With iCloud, users can sync internet artifacts, pictures, documents, calls, messages, notes, contacts, calendar entries and their Keychain between iOS and OS X devices (and some services to Windows devices). The discovery of the existence of an iCloud account could potentially lead investigators to other devices, and more data than what was first known to be available.

Data contained in an iCloud account could lead investigators to serve Apple with court documents to obtain some of this data. The only question that remains is, where does one find this information on a computer running OS X?

/Users/<username>/Library/Preferences/MobileMeAccounts.plist

This file contains the iCloud ID (Apple ID) for each user of the computer. The file is an absolute must for investigators to know and understand.

Now you know.

Need more? Contact the BlackBag training team to book your seat in one of our upcoming Mac forensic courses.

Leave a Reply

Sorry, you must be logged in to post a comment.