iTunes and iCloud are the most used methods for iOS device support. iTunes/Finder provides free methods for backing up, syncing, and restoring data to your iOS device from your Macintosh or Windows computer. iTunes can also be used to create a forensic backup, which is discussed in Backup File Forensics in Section 4.

Once an iOS device is backed up as an “encrypted device," the password used for the initial encryption is required for future access to the device backup files and for opting to no longer back up using encryption. For example, if I backed up my iPad using the password HeatherM11, the next time I attempt to back up the iPad on ANY computer, iTunes automatically checks the Encrypt Local Backup option. To uncheck this option, I am required to enter HeatherM11, which releases the encryption restriction on this device. Keep this in mind in the next section discussing iOS forensic acquisition. This backup encryption can cause issues for you as an examiner.

iCloud provides 5 GB of free data storage for each iOS device. iCloud functions just like iTunes but omits the need to connect to a computer. iCloud also offers a feature called Find My iPhone, which allows the user to remotely locate their device, send a message, or erase the iOS device. As trained examiners, we must prevent remote access from occurring on the iOS device.

Knowing how the user backs up their data may lead you to another device (host computer) or permit access to cloud data, which can open up a whole world of artifacts. Remember, just because we have moved on from Android, we still have to consider Google cloud data for iOS devices. This is something that should also be extracted and examined if possible.