Page 1
ICLOUD: THEACCOUNTASEVIDENCE · A GUIDE FOR UK LAWYERS iCloud: The Account as the Real Evidence Store Why the Evidence Often Lives in the Account, Not the Device, and How to Reach It Lawfully COMPUTER FORENSICS LAB
§ ABOUT THE AUTHOR PREPARED BY COMPUTER FORENSICS LAB E-DISCOVERY TEAM FULL CHAIN-OF-CUSTODY DOCUMENTATION
§ CONTENTS In this guide 01 Executive summary 02 The problem in plain English: the account behind the device 03 What iCloud holds 04 Why the account is the real evidence store 05 Reaching iCloud law full y 06 Advanced Data Protection and what changes 07 Deployment: the account as source and fallback 08 Source architecture: where else the evidence lives 09 Worked examples 10 Common mistakes and technical limitations 11 Questions to ask · Suggested wording 12 Checklist and red flags · When to involve a digital forensic expert 13 Frequently asked questions 14 Glossary · References · Disclaimer · How a specialist laboratory can assist
§ 01 · ORIENTATION Executive summary iCloud account behind it, which holds photos, messages, backups of every device, files and app data, often only route when a device is gone, but reachable only law full y.
§ 02 · FIRST PRINCIPLES The problem in plain English: the account behind the device
§ 03 · WHAT I CLOUD HOLD S What iCloud holds
Page 2
§ 04 · THEREALEVIDENCESTORE Why the account is the real evidence store
§ 05 · REACHINGICLOUDLAWFULLY Reaching iCloud law full y
§ 06 · ADVANCEDDATAPROTECTION Advanced Data Protection and what changes
§ 07 · DEPLOYMENT Deployment: the account as source and fallback
§ 08 · THEWIDERMAP Source architecture: where else the evidence lives EVIDENCE ACCOUNT DEVICES (NO ADP) (ADP ON) DEVICE OTHER CLOUD
§ 09 · IN THE WILD Worked examples EXAMPLE1 · THEWIPEDPHONEANDTHEINTACTACCOUNT EXAMPLE2 · ADVANCEDDATAPROTECTIONCHANGEDTHEROUTE, NOTTHEOUTCOME EXAMPLE3 · THEACCOUNTTHATHELDTHEOLDERHISTORY
Page 3
§ 10 · WHEREITGOESWRONG Common mistakes and technical limitations Common mistakes Technical limitations
§ 11 · INTERROGATORIES & DRAFTING AIDS Questions to ask · Suggested wording Ask your client Ask your opponent Ask your e Discovery / forensic provider
§ 12 · QUICK CONTROL Checklist and red flags · When to involve a digital forensic expert The iCloud account checklist Red flags When to involve a digital forensic expert
§ 13 · COMMON QUESTIONS Frequently asked questions Why look at iCloud rather than just the phone? If a phone is wiped or lost, is the evidence gone? How is iCloud data obtained law full y? What is Advanced Data Protection and why does it matter? Does the account show what devices someone has? Isn't collecting a whole iCloud account very intrusive?
§ 14 · REFERENCE Glossary Sources and authoritative references DISCLAIMER
§ HOW A SPECIALIST LABORATORY CAN ASSIST Working with Computer Forensics Lab 35 or CrimPR Part 19. This guide continues the iPhone and iPad block. Conflicts checks, confidential scoping Speak to a forensic examiner, not a salesperson. INSTRUCTTHELAB NEWENQUIRIESEMAILE - DISCOVERY
Cite as: Joseph Naghdi, ICloud The Account As The Real Evidence Store, Computer Forensics Lab, https://e-discovery.uk/library/icloud-the-account-as-the-real-evidence-store/pdf.