iCloud Backup
Definition
A daily encrypted snapshot of an iPhone or iPad stored in Apple's cloud. Includes app data the developer marks for backup, device settings, Home Screen layout, iMessage (default), SMS/MMS, ringtones, Apple Watch backup, photos if iCloud Photos is off, Health (encrypted), and Keychain (E2E).
- Frequency
- Daily, when device is charging and on Wi-Fi
- Includes
- App data, settings, iMessage, SMS/MMS, Health, Keychain
- Photos
- Included only if iCloud Photos is turned off
- Health and Keychain
- Stored encrypted, Keychain end-to-end
Common questions
Why do investigators sometimes prefer iCloud backup data over a physical device extraction?+
A cloud backup can be obtained through legal process from Apple even when the physical device is locked, wiped, or unavailable, and it captures data across the account's linked devices. It does not replace a full physical extraction, which typically recovers more, but it is often faster to obtain.
Does iCloud backup capture everything on the device?+
No. Data belongs in the backup only if the app developer opted it in, and photos are excluded once iCloud Photos syncing is enabled, since that data already lives in iCloud separately rather than in the daily backup snapshot.
Related terms
- Advanced Data Protection (ADP)
- Apple's opt-in feature since iOS 16.2 (December 2022 in US, global by iOS 16.3) that extends end-to-end encryption to iCloud Backup, iCloud...
- Android Auto Backup
- The Android 6.0+ mechanism that uploads app data to the user's Google Drive automatically (up to 25 MB per app), alongside SMS,...
- BNSS Section 91
- Bharatiya Nagarik Suraksha Sanhita 2023 Section 91 (successor to CrPC 1973 Section 91) lets a court or officer in charge of a...
- CLOUD Act
- The Clarifying Lawful Overseas Use of Data Act (US, 2018). Clarifies that US service providers must comply with valid US legal process...
- Google Legal Investigations Support
- Google's process for handling law enforcement requests, documented at its transparency report portal. Google distinguishes between emergency disclosure requests (no legal process...
- MLAT
- Mutual Legal Assistance Treaty. The formal mechanism for cross-border evidence requests. India has bilateral MLATs with over 40 countries including the US,...
- MLAT (Mutual Legal Assistance Treaty)
- A bilateral or multilateral treaty framework through which countries agree to provide legal cooperation in criminal investigations, including compelling disclosure of evidence...
- OAuth Token Acquisition
- Cloud-extraction technique where a tool authenticates to the provider using the user's account credentials or a refresh token extracted from the phone,...
- Preservation Letter
- A formal written request to a cloud provider asking it to preserve a specific account's data for a defined period, typically 90...
- Stored Communications Act (SCA)
- Part of the US Electronic Communications Privacy Act (18 U.S.C. 2701-2712) that governs government access to stored electronic communications and data. It...
- TCC.db
- Transparency, Consent and Control database at /var/mobile/Library/TCC/TCC.db on iOS. Records which apps the user has granted access to camera, microphone, photos, contacts,...
Explained in these topics
- Cloud Account ForensicsApple's device backup service that stores a snapshot of an iOS or iPadOS device to Apple's servers, including app data, messages, photos, call logs, and settin...
- Mobile Cloud and Backup Forensics: iCloud and Google Drive