iOS Backup vs iCloud How can you compare?

Written by Amber Schroader

June 29, 2021

When you process an iOS device there are multiple locations that will provide you the data you are looking for. It is important to understand where you can see the differences in those data sources. Depending on your process checklist you might choose a different data source as a primary to compare with the other available iOS data sources. In this walk through we will compare the differences between an iOS backup and an iCloud backup.

iOS backups can be made through either a backup from either your tool or iTunes or the use of an encrypted backup from your tool or iTunes. If the iTunes method is used it would then be imported through your tool.

Once the data is imported into your forensic tool you will want to go to the device information. In this information, the data for the Last Backup Date should be displayed. This is the last backup date that was done with the device and the primary machine.

If you are using the E3 Forensic Platform you can use the Mobile Evidence Comparer to see data that has changed between backups of a device. This method is quick and easy and shows exact changes that have occurred.

When you are dealing with an iCloud backup you will need to import that data into your tool first and then review the data. When you look at the iCloud backup pay attention to the name of the folder with the backup data. It contains the date and time the backup was made.

You can then easily bring the iCloud data in for a case compare to show what changed from one date to another. It is important to note that you cannot get all of the keychain data, and tokens with an iCloud backup image. You still must do an encrypted backup with a known password to get that data.

Differences in iCloud Backups

It is important to understand the difference between a full iCloud backup versus a standard iCloud backup.

Example 1.

A standard iCloud account only comes with 5 GB of storage. This will only allow end-users to backup specific items to their iCloud account (up to 5GB of data), based upon the size of the device. Their backup will only include these items.

Example 2.

If the ender user chooses to purchase additional storage in iCloud, this will allow the end-user to do a full backup directly to iCloud of all data (depending on storage purchased).  In the example below additional storage was purchased and the end-user archived a full backup from iTunes. This is what would compare the most directly with the iOS backup done by your forensic tools.

Why compare your cases?

This is a valuable step if your case is taking a while to be completed and changes in your tools have happened. You can reprocess and review the data against your original to see what new capabilities might have happened with your forensic tool. This compare function can also be used to compare a case that has been processed by another party and comes back to you as the primary examiner. It can show details of what might have been changed through the other parties’ processing. An example below can be seen where an address entry change occurred between one party and the other parties’ examinations.

These results can have separate reports generated that focus on these changes. The case compare functionality can be valuable in your validation of your forensic tool and the work of the other side of the case. For more details on this sign up for our eBook on writing a validation plan here

smartphone forensic training

Forensic-Impact Articles

Expectations of Facebook Data

Expectations of Facebook Data

As social media continues to rise so does the power of Facebook. If you are not on it personally you are for your business or to connect with people on a hobby. That being part of the Meta universe has become as essential as getting a driver’s license. So, what does...

EMI Shielding & Why You Need It

EMI Shielding & Why You Need It

The topic of Physics may not be the first thing that comes to mind when you think of digital forensics, but it does play a key role in the preservation of your digital evidence. Not every organization is lucky enough to have their lab so isolated that they get no...

Due Diligence of Tool Selection

Due Diligence of Tool Selection

In the season of shopping, many of you might be considering shopping for new tools for your labs. I stepped back to put this together because as I shop for tools for our lab, I don’t judge on the same standard that I do as a tool producer. I, however, always do my due...