Through iCloud, the user can access, update, and sync their contacts, email, and calendar data from all devices that share the iCloud account. For instance, if a new contact is entered on the iPhone, it will automatically get synced to the user’s computer, and vice versa. Reminders (iOS 5 and above), Safari bookmarks, iBooks bookmarks, and Notes can also be synced when enabled on the device. Photo Stream pushes photos taken with one device to all other devices associated with the iCloud account.

When enabled, these items sync across all devices associated with the iCloud account. This can potentially be problematic to an investigation, as it is possible that data could end up on a device without the user’s knowledge if someone else on the same iCloud account knowingly or unknowingly synced the data via iCloud. It is important to be sure you know exactly where the data in your investigation came from to avoid the wrong person being held responsible. Make sure you examine the CloudConfigurationDetails.plist to ensure you are not missing the truth.

References:

[1] https://for585.com/9ykjn (iCloud Sync information)

[2] https://for585.com/r2x4b (Murphy’s Laws of Digital Forensics blog post – Apple Continuity and iCloud Data Leakage when Apple Bites Back)