Insights Blog

Does the User Have an iCloud Account?

With Apple integrating numerous services between iOS and OS X devices, knowing that a user has an iCloud account can be invaluable in an investigation. With iCloud, users can sync internet artifacts, pictures, documents, calls, messages, notes, contacts, calendar entries and their Keychain between iOS and OS X devices (and some services to Windows devices). The discovery of the existence of an iCloud account could potentially lead investigators to other devices, and more data than what was first known to be available.

Data contained in an iCloud account could lead investigators to serve Apple with court documents to obtain some of this data. The only question that remains is, where does one find this information on a computer running OS X?

/Users/<username>/Library/Preferences/MobileMeAccounts.plist

This file contains the iCloud ID (Apple ID) for each user of the computer. The file is an absolute must for investigators to know and understand.

Now you know.

Need more? Contact the BlackBag training team to book your seat in one of our upcoming Mac forensic courses.

BlackBag Training Team

Our trusted training team has real world experience and are experts at delivering training you can use immediately. They have a passion for sharing techniques examiners can use every day to solve cases.Meet our training team and learn more about our courses at https://www.blackbagtech.com/training/
BlackBag Training Team