Elcomsoft has the capability of collecting data that is synced by Apple and data that is backed up by the user. In some situations, this data may be similar. However, look at the differences in what is collected. On the left, we can see some items that have an orange (or lighter shaded) checkbox. The lighter shading means the phone passcode must be entered to extract this information. That is the only thing protecting this data. When possible, collect both the Synced data from iCloud and the iCloud backup files.

Above, we see the options, as previously discussed, when the examiner elects to download the iCloud backup.