Page 1

ICLOUD: THEACCOUNTASEVIDENCE · A GUIDE FOR UK LAWYERS iCloud: The Account as the Real Evidence Store Why the Evidence Often Lives in the Account, Not the Device, and How to Reach It Lawfully COMPUTER FORENSICS LAB

§ ABOUT THE AUTHOR PREPARED BY COMPUTER FORENSICS LAB E-DISCOVERY TEAM FULL CHAIN-OF-CUSTODY DOCUMENTATION

§ CONTENTS In this guide 01 Executive summary 02 The problem in plain English: the account behind the device 03 What iCloud holds 04 Why the account is the real evidence store 05 Reaching iCloud law full y 06 Advanced Data Protection and what changes 07 Deployment: the account as source and fallback 08 Source architecture: where else the evidence lives 09 Worked examples 10 Common mistakes and technical limitations 11 Questions to ask · Suggested wording 12 Checklist and red flags · When to involve a digital forensic expert 13 Frequently asked questions 14 Glossary · References · Disclaimer · How a specialist laboratory can assist

§ 01 · ORIENTATION Executive summary iCloud account behind it, which holds photos, messages, backups of every device, files and app data, often only route when a device is gone, but reachable only law full y.

§ 02 · FIRST PRINCIPLES The problem in plain English: the account behind the device

§ 03 · WHAT I CLOUD HOLD S What iCloud holds