Top Banner
Sarah Edwards | @iamevltwin | [email protected] | mac4n6.com
68

Sarah Edwards | @iamevltwin | [email protected] | mac4n6 · iCloud Basics Storage and Acquisition of iCloud Data Synced Preferences Application Data

May 24, 2020

Download

Documents

dariahiddleston
Welcome message from author
This document is posted to help you gain knowledge. Please leave a comment to let me know what you think about it! Share it to your friends and learn new things together.
Transcript
Page 1: Sarah Edwards | @iamevltwin | oompa@csh.rit.edu | mac4n6 · iCloud Basics Storage and Acquisition of iCloud Data Synced Preferences Application Data

Sarah Edwards | @iamevltwin | [email protected] | mac4n6.com

Page 2: Sarah Edwards | @iamevltwin | oompa@csh.rit.edu | mac4n6 · iCloud Basics Storage and Acquisition of iCloud Data Synced Preferences Application Data

By Day – Test Engineer at Parsons Corporation (Government Contractor)

By Night – SANS Author & Instructor

• FOR518 – Mac Forensic Analysis (sans.org/course/mac-forensic-analysis)

• Upcoming classes:

• August/September – Virginia Beach

• September – Las Vegas

• October – Singapore

• October – Prague

• Anytime - OnDemand

At All Times - Mac Fan Girl

The latest and greatest version of this presentation is available at: mac4n6.com

Page 3: Sarah Edwards | @iamevltwin | oompa@csh.rit.edu | mac4n6 · iCloud Basics Storage and Acquisition of iCloud Data Synced Preferences Application Data

iCloud Basics

Storage and Acquisition of iCloud Data

Synced Preferences

Application Data

Page 4: Sarah Edwards | @iamevltwin | oompa@csh.rit.edu | mac4n6 · iCloud Basics Storage and Acquisition of iCloud Data Synced Preferences Application Data
Page 5: Sarah Edwards | @iamevltwin | oompa@csh.rit.edu | mac4n6 · iCloud Basics Storage and Acquisition of iCloud Data Synced Preferences Application Data

What is “Everything”?

• Documents

• Email

• Contacts

• Preference Configurations

• Photos

• Calendar

• Notes

• Reminders

• and more!

Page 6: Sarah Edwards | @iamevltwin | oompa@csh.rit.edu | mac4n6 · iCloud Basics Storage and Acquisition of iCloud Data Synced Preferences Application Data
Page 7: Sarah Edwards | @iamevltwin | oompa@csh.rit.edu | mac4n6 · iCloud Basics Storage and Acquisition of iCloud Data Synced Preferences Application Data
Page 8: Sarah Edwards | @iamevltwin | oompa@csh.rit.edu | mac4n6 · iCloud Basics Storage and Acquisition of iCloud Data Synced Preferences Application Data
Page 9: Sarah Edwards | @iamevltwin | oompa@csh.rit.edu | mac4n6 · iCloud Basics Storage and Acquisition of iCloud Data Synced Preferences Application Data

Email: Apple ID

Numeric: iCloud

“Person ID” Vetted Account

Aliases

Email Addresses

Phone Numbers

Credentials

Password

Two-factor

Token

Storage

5GB Data Free

Can purchase up to

1TB

Page 10: Sarah Edwards | @iamevltwin | oompa@csh.rit.edu | mac4n6 · iCloud Basics Storage and Acquisition of iCloud Data Synced Preferences Application Data

OS X

• ~/Library/Application Support/iCloud/Accounts

iOS

• /private/var/mobile/Library/Preferences/com.apple.ubd.plist

Windows

• HKEY_CURRENT_USER\Software\Apple Inc.\Internet Services

Page 11: Sarah Edwards | @iamevltwin | oompa@csh.rit.edu | mac4n6 · iCloud Basics Storage and Acquisition of iCloud Data Synced Preferences Application Data
Page 12: Sarah Edwards | @iamevltwin | oompa@csh.rit.edu | mac4n6 · iCloud Basics Storage and Acquisition of iCloud Data Synced Preferences Application Data

On Disk

•OS X - Disk Image

•Windows - Disk Image

•iOS

•Physical Acquisition - Jailbreak required for iPhone4S generations and newer.

•or SSH

•or “Physical Logical” (Elcomsoft EIFT, “save user files to .tar archive”)

iCloud.com

•Various Download Tools

Downloadable Storage Types

•iCloud Backups (iTunes-ish Backups)

•iCloud Data (Mobile Documents, Photos, Synced Preferences, etc)

Page 13: Sarah Edwards | @iamevltwin | oompa@csh.rit.edu | mac4n6 · iCloud Basics Storage and Acquisition of iCloud Data Synced Preferences Application Data

Sketchy

• iPhone Backup Extractor - http://www.iphonebackupextractor.com/

• iPhone Data Recovery - http://www.iskysoft.com/data-recovery/how-to-download-icloud-backup.html

Slightly Less Sketchy?

• iLoot - https://github.com/hackappcom/iloot

Forensic

• Elcomsoft Phone Breaker (EPPB) - https://www.elcomsoft.com/eppb.html

Page 14: Sarah Edwards | @iamevltwin | oompa@csh.rit.edu | mac4n6 · iCloud Basics Storage and Acquisition of iCloud Data Synced Preferences Application Data

• iLoot: • Apple ID Required

• No Two-factor Support

• Python! Run Anywhere

• Command-line Only

• Open Source

• Free!

Page 15: Sarah Edwards | @iamevltwin | oompa@csh.rit.edu | mac4n6 · iCloud Basics Storage and Acquisition of iCloud Data Synced Preferences Application Data

• Elcomsoft Phone Breaker (EPPB) “Forensic”

Apple ID or Authentication Token

Support for Two-factor

Mac or Windows

Professional or Forensic Editions

• iCloud Backups & iCloud Files (iCloud Drive)

• $200, $800

Page 16: Sarah Edwards | @iamevltwin | oompa@csh.rit.edu | mac4n6 · iCloud Basics Storage and Acquisition of iCloud Data Synced Preferences Application Data
Page 17: Sarah Edwards | @iamevltwin | oompa@csh.rit.edu | mac4n6 · iCloud Basics Storage and Acquisition of iCloud Data Synced Preferences Application Data

• Contains synced preferences for: • Email

• Safari

• WiFi

• Maps

• Stocks

• Weather

• Messages

• Legacy & Sandboxed Locations • ~/Library/SyncedPreferences/

• ~/Library/Containers/…

Page 18: Sarah Edwards | @iamevltwin | oompa@csh.rit.edu | mac4n6 · iCloud Basics Storage and Acquisition of iCloud Data Synced Preferences Application Data

• OSX: • ~/Library/SyncedPreferences/com.apple.mail-com.apple.mail.recents.plist

• ~/Library/Containers/com.apple.corerecents.recentsd/Data/Library/SyncedPreferences/recentsd-com.apple.mail.recents.plist

• iOS: /private/var/mobile/Library/SyncedPreferences/com.apple.cloudrecents.CloudRecentsAgent-com.apple.mail.recents.plist

Page 19: Sarah Edwards | @iamevltwin | oompa@csh.rit.edu | mac4n6 · iCloud Basics Storage and Acquisition of iCloud Data Synced Preferences Application Data

• MR – Single Contact • GP – Group Email

Page 20: Sarah Edwards | @iamevltwin | oompa@csh.rit.edu | mac4n6 · iCloud Basics Storage and Acquisition of iCloud Data Synced Preferences Application Data

• OS X: • ~/Library/SyncedPreferences/com.apple.mail-com.apple.mail.vipsenders.plist

• ~/Library/Containers/com.apple.mail/Data/Library/SyncedPreferences/com.apple.mail-com.apple.mail.vipsenders.plist

• iOS: • /private/var/mobile/Applications/<GUID>/Library/SyncedPreferences/com.apple.mobilemail-

com.apple.mail.vipsenders.plist

• /private/var/mobile/Containers/Data/Application/<GUID>/Library/SyncedPreferences/com.apple.mobilemail-com.apple.mail.vipsenders.plist

Page 21: Sarah Edwards | @iamevltwin | oompa@csh.rit.edu | mac4n6 · iCloud Basics Storage and Acquisition of iCloud Data Synced Preferences Application Data

• OS X: ~/Library/Containers/com.apple.corerecents.recentsd/Data/Library/SyncedPreferences/recentsd-com.apple.messages.recents.plist

• iOS: /private/var/mobile/Library/SyncedPreferences/com.apple.cloudrecents.CloudRecentsAgent-com.apple.messages.recents.plist

Page 22: Sarah Edwards | @iamevltwin | oompa@csh.rit.edu | mac4n6 · iCloud Basics Storage and Acquisition of iCloud Data Synced Preferences Application Data

• MR = Single Recipient, GR = Group

Page 23: Sarah Edwards | @iamevltwin | oompa@csh.rit.edu | mac4n6 · iCloud Basics Storage and Acquisition of iCloud Data Synced Preferences Application Data

• OS X: ~/Library/SyncedPreferences/com.apple.Safari.plist

• iOS: • /private/var/mobile/Applications/

<GUID>/Library/SyncedPreferences/com.apple.mobilesafari.plist

• /private/var/mobile/Containers/Data/Application/<GUID>/Library/SyncedPreferences/com.apple.mobilesafari.plist

Page 24: Sarah Edwards | @iamevltwin | oompa@csh.rit.edu | mac4n6 · iCloud Basics Storage and Acquisition of iCloud Data Synced Preferences Application Data
Page 25: Sarah Edwards | @iamevltwin | oompa@csh.rit.edu | mac4n6 · iCloud Basics Storage and Acquisition of iCloud Data Synced Preferences Application Data
Page 26: Sarah Edwards | @iamevltwin | oompa@csh.rit.edu | mac4n6 · iCloud Basics Storage and Acquisition of iCloud Data Synced Preferences Application Data

• OS X:

~/Library/SyncedPreferences/

com.apple.wifi.WiFiAgent.plist

• iOS:

/private/var/mobile/Library/Sy

ncedPreferences/com.apple.

wifid.plist

Page 27: Sarah Edwards | @iamevltwin | oompa@csh.rit.edu | mac4n6 · iCloud Basics Storage and Acquisition of iCloud Data Synced Preferences Application Data
Page 28: Sarah Edwards | @iamevltwin | oompa@csh.rit.edu | mac4n6 · iCloud Basics Storage and Acquisition of iCloud Data Synced Preferences Application Data

• OS X: • ~/Library/SyncedPreferences/com.apple.

Maps-com.apple.MapsSupport.bookmarks.plist

• ~/Library/Containers/com.apple.Maps/Data/Library/SyncedPreferences/com.apple.Maps-com.apple.MapsSupport.bookmarks.plist

• iOS: • /private/var/mobile/Library/SyncedPrefer

ences/com.apple.Maps.plist • /private/var/mobile/Containers/Data/Ap

plication/<GUID>/Library/SyncedPreferences/com.apple.Maps-com.apple.MapsSupport.bookmarks.plist

Page 29: Sarah Edwards | @iamevltwin | oompa@csh.rit.edu | mac4n6 · iCloud Basics Storage and Acquisition of iCloud Data Synced Preferences Application Data
Page 30: Sarah Edwards | @iamevltwin | oompa@csh.rit.edu | mac4n6 · iCloud Basics Storage and Acquisition of iCloud Data Synced Preferences Application Data

• Recent Addresses (Extracted from Mail emails – “From…”) • OS X:

~/Library/Containers/com.apple.corerecents.recentsd/Data/Library/SyncedPreferences/recentsd-com.apple.corerecents.map-locations.plist

• iOS: /private/var/mobile/Library/SyncedPreferences/com.apple.cloudrecents.CloudRecentsAgent-com.apple.corerecents.map-locations.plist

• Recent Locations & Searches • OS X:

• ~/Library/SyncedPreferences/com.apple.Maps-com.apple.MapsSupport.history.plist

• /Users/oompa/Library/Containers/com.apple.Maps/Data/Library/SyncedPreferences/com.apple.Maps-com.apple.MapsSupport.history.plist

• iOS: • /private/var/mobile/Library/SyncedPreferences/com.apple.Maps-

com.apple.Maps.recents.plist

• /private/var/mobile/Containers/Data/Application/<GUID>/Library/SyncedPreferences/com.apple.Maps-com.apple.Maps.recents.plist

• /private/var/mobile/Containers/Data/Application/<GUID>/Library/SyncedPreferences/com.apple.Maps-com.apple.MapsSupport.history.plist

Page 31: Sarah Edwards | @iamevltwin | oompa@csh.rit.edu | mac4n6 · iCloud Basics Storage and Acquisition of iCloud Data Synced Preferences Application Data

• Extracted from Mail emails – “From…”

Page 32: Sarah Edwards | @iamevltwin | oompa@csh.rit.edu | mac4n6 · iCloud Basics Storage and Acquisition of iCloud Data Synced Preferences Application Data
Page 33: Sarah Edwards | @iamevltwin | oompa@csh.rit.edu | mac4n6 · iCloud Basics Storage and Acquisition of iCloud Data Synced Preferences Application Data
Page 34: Sarah Edwards | @iamevltwin | oompa@csh.rit.edu | mac4n6 · iCloud Basics Storage and Acquisition of iCloud Data Synced Preferences Application Data
Page 35: Sarah Edwards | @iamevltwin | oompa@csh.rit.edu | mac4n6 · iCloud Basics Storage and Acquisition of iCloud Data Synced Preferences Application Data

Pages

•~/Library/Mobile Documents/com~apple~Pages/

Keynote

•~/Library/Mobile Documents/com~apple~Keynote/

Numbers

•~/Library/Mobile Documents/com~apple~Numbers/

TextEdit

•~/Library/Mobile Documents/com~apple~TextEdit/

Other

•~/Library/Mobile Documents/com~apple~CloudDocs/

Page 36: Sarah Edwards | @iamevltwin | oompa@csh.rit.edu | mac4n6 · iCloud Basics Storage and Acquisition of iCloud Data Synced Preferences Application Data

• com~apple~Numbers (& Keynote, Pages, & TextEdit)

• “Documents” Directory

• iWorkPreviews Directory (iWork Only) • com~apple~CloudDocs

• No “Documents” Directory

Page 37: Sarah Edwards | @iamevltwin | oompa@csh.rit.edu | mac4n6 · iCloud Basics Storage and Acquisition of iCloud Data Synced Preferences Application Data

• iOS: /private/var/mobile/Library/Mobile Documents/

Page 38: Sarah Edwards | @iamevltwin | oompa@csh.rit.edu | mac4n6 · iCloud Basics Storage and Acquisition of iCloud Data Synced Preferences Application Data

• Follows same structure • Kinda Funky – Need to

research • Waiting on 8.2/8.3

Jailbreak

• Hidden plist files • <document_name>.icloud • Theories

• Files had yet to be downloaded to device?

• Pointer Records?

• Image acquired in strange state?

Page

58

Page 39: Sarah Edwards | @iamevltwin | oompa@csh.rit.edu | mac4n6 · iCloud Basics Storage and Acquisition of iCloud Data Synced Preferences Application Data

• Similar directory structure: • com~apple~KeyNote

(Pages, Numbers, TextEdit)

Page 40: Sarah Edwards | @iamevltwin | oompa@csh.rit.edu | mac4n6 · iCloud Basics Storage and Acquisition of iCloud Data Synced Preferences Application Data

• OS X - Legacy Location w/ Old iPhoto App: • ~/Library/Application Support/iLifeAssetManagement/

Page 41: Sarah Edwards | @iamevltwin | oompa@csh.rit.edu | mac4n6 · iCloud Basics Storage and Acquisition of iCloud Data Synced Preferences Application Data

• OS X - Legacy Location w/ Old iPhoto App:

• ~/Library/Application Support/iLifeAssetManagement/

• Photo Metadata – iLifeAssetManagement.db

• Only stores data about iCloud related photos. (Other photo data found in iPhoto Library files.)

Page 42: Sarah Edwards | @iamevltwin | oompa@csh.rit.edu | mac4n6 · iCloud Basics Storage and Acquisition of iCloud Data Synced Preferences Application Data

• OS X – iLifeAssetManagement.db • SQLite Database • Contains iCloud photo metadata in

AMAsset table: • Photo UUID

• iCloud Person ID

• Timestamps (Downloaded, Modified, Created)

• Height/Width

• Filename

• File Size

• Device UDID

Page 43: Sarah Edwards | @iamevltwin | oompa@csh.rit.edu | mac4n6 · iCloud Basics Storage and Acquisition of iCloud Data Synced Preferences Application Data

Your Photo Stream Photos - sub/

Shared Photo Stream Photos - sub-shared/

Page 44: Sarah Edwards | @iamevltwin | oompa@csh.rit.edu | mac4n6 · iCloud Basics Storage and Acquisition of iCloud Data Synced Preferences Application Data

• OS X – New Location w/ new OS X Photos App: • ~/Pictures/Photos

Library.photoslibrary/

• Local photos and iCloud photos are integrated.

Page 45: Sarah Edwards | @iamevltwin | oompa@csh.rit.edu | mac4n6 · iCloud Basics Storage and Acquisition of iCloud Data Synced Preferences Application Data

• OS X – New Location w/ new OS X Photos App: • ~/Pictures/Photos Library.photoslibrary/

Page 46: Sarah Edwards | @iamevltwin | oompa@csh.rit.edu | mac4n6 · iCloud Basics Storage and Acquisition of iCloud Data Synced Preferences Application Data

• OS X – New Location w/ new OS X Photos App: • ~/Pictures/Photos Library.photoslibrary/

• Masters Directory: The photos themselves • JPG - Photos

• PNG - Screenshots

• MOV – Movies

• Time stamped File Paths

• Extended Attribute: com.apple.quarantine = cloudphotosd, iCloud

Page 47: Sarah Edwards | @iamevltwin | oompa@csh.rit.edu | mac4n6 · iCloud Basics Storage and Acquisition of iCloud Data Synced Preferences Application Data

• OS X – Photos App Metadata • ~/Pictures/Photos

Library.photoslibrary/Databases/Library.apdb • Link to

/apdb/Library.apdb

• SQLite Database

Page 48: Sarah Edwards | @iamevltwin | oompa@csh.rit.edu | mac4n6 · iCloud Basics Storage and Acquisition of iCloud Data Synced Preferences Application Data

• OS X – Photos App Metadata – Library.apdb • Photo UUID

• File Name

• Timestamps (imageDate, Create, Export Image, Export Metadata,

• Height/Width/Rotation

• Associated Notes Flag

• Location Latitude/Longitude

• Time Zone

• Reversed Location Blob Data (similar to reverse IP location)

• More!

• Have not yet found relationship to Device UDID.

Page 49: Sarah Edwards | @iamevltwin | oompa@csh.rit.edu | mac4n6 · iCloud Basics Storage and Acquisition of iCloud Data Synced Preferences Application Data

• iOS iCloud Photos: • Photos: /private/var/mobile/Media/PhotoStreamsData/<iCloud_Person_ID>/1##APPLE/*

• Metadata: /private/var/mobile/Media/PhotoStreamsData/<iCloud_Person_ID>/.MISC/*

Page 50: Sarah Edwards | @iamevltwin | oompa@csh.rit.edu | mac4n6 · iCloud Basics Storage and Acquisition of iCloud Data Synced Preferences Application Data

• iOS iCloud Photos – Shared Albums • Shared Album Data:

/private/var/mobile/Media/PhotoData/PhotoCloudSharingData/<iCloud_Person_ID>/<GUID>/

• Shared with whom?: ZCLOUDSHAREDALBUMINVINTATIONRECORD Table - /private/var/mobile/Media/PhotoData/Photos.sqlite

• Correlate the GUIDs

• iCloud Shared Photo Comments in ZCLOUDSHAREDCOMMENT Table

Page 51: Sarah Edwards | @iamevltwin | oompa@csh.rit.edu | mac4n6 · iCloud Basics Storage and Acquisition of iCloud Data Synced Preferences Application Data

• “My Photo Stream”

• “Shared”

• “New Condo”

• “Arch”

• “Condo”

• “Copenhagen and

St…”

Page 52: Sarah Edwards | @iamevltwin | oompa@csh.rit.edu | mac4n6 · iCloud Basics Storage and Acquisition of iCloud Data Synced Preferences Application Data

• C:\Users\<user>\Pictures\iCloud Photos\My Photo Stream\

Page 53: Sarah Edwards | @iamevltwin | oompa@csh.rit.edu | mac4n6 · iCloud Basics Storage and Acquisition of iCloud Data Synced Preferences Application Data

• C:\Users\<user>\P

ictures\iCloud

Photos\My Photo

Stream\

• IMG_####.JPG or

PNG

Page 54: Sarah Edwards | @iamevltwin | oompa@csh.rit.edu | mac4n6 · iCloud Basics Storage and Acquisition of iCloud Data Synced Preferences Application Data

• C:\Users\<user>\Pictur

es\iCloud

Photos\Shared\

• Directory is Shared

Album Name (“Arch”)

• <43_alphanum_charac

ters>.JPG or PNG

Page 55: Sarah Edwards | @iamevltwin | oompa@csh.rit.edu | mac4n6 · iCloud Basics Storage and Acquisition of iCloud Data Synced Preferences Application Data

• OS X: ~/Library/Mobile

Documents/com~apple

~shoebox/UbiquitousCar

ds/

• iOS:

/private/var/mobile/Libr

ary/Passes/Cards/

Page 56: Sarah Edwards | @iamevltwin | oompa@csh.rit.edu | mac4n6 · iCloud Basics Storage and Acquisition of iCloud Data Synced Preferences Application Data
Page 57: Sarah Edwards | @iamevltwin | oompa@csh.rit.edu | mac4n6 · iCloud Basics Storage and Acquisition of iCloud Data Synced Preferences Application Data

• Pass Information - pass.json Files

Page 58: Sarah Edwards | @iamevltwin | oompa@csh.rit.edu | mac4n6 · iCloud Basics Storage and Acquisition of iCloud Data Synced Preferences Application Data
Page 59: Sarah Edwards | @iamevltwin | oompa@csh.rit.edu | mac4n6 · iCloud Basics Storage and Acquisition of iCloud Data Synced Preferences Application Data

• OS X: ~/Library/Containers/com.apple.Notes/Data/Library/Notes/NotesV4.storedata

• iOS: /private/var/mobile/Library/Notes/notes.sqlite • SQLite Tables: ZNOTE & ZNOTEBODY

• Note Creation & Edited Time

• Note Title & Contents

Page 60: Sarah Edwards | @iamevltwin | oompa@csh.rit.edu | mac4n6 · iCloud Basics Storage and Acquisition of iCloud Data Synced Preferences Application Data
Page 61: Sarah Edwards | @iamevltwin | oompa@csh.rit.edu | mac4n6 · iCloud Basics Storage and Acquisition of iCloud Data Synced Preferences Application Data
Page 62: Sarah Edwards | @iamevltwin | oompa@csh.rit.edu | mac4n6 · iCloud Basics Storage and Acquisition of iCloud Data Synced Preferences Application Data

• OS X: ~/Library/Calendars/Calendar Cache • iOS: /private/var/mobile/Library/Calendar/Calendar.sqlitedb • SQLite Table: ZCALENDARITEM

• Calendar item creation time and title.

Page 63: Sarah Edwards | @iamevltwin | oompa@csh.rit.edu | mac4n6 · iCloud Basics Storage and Acquisition of iCloud Data Synced Preferences Application Data
Page 64: Sarah Edwards | @iamevltwin | oompa@csh.rit.edu | mac4n6 · iCloud Basics Storage and Acquisition of iCloud Data Synced Preferences Application Data

• OS X: ~/Library/Application Support/AddressBook/Sources/<GUID>/AddressBook-v22.abcddb

• iOS: /private/var/mobile/Library/AddressBook/AddressBook.sqlitdb • SQLite Tables: ZABCDRECORD & ZABCDPHONENUMBER

• Contact Name & Number

• Contact Creation and Modification Dates

Page 65: Sarah Edwards | @iamevltwin | oompa@csh.rit.edu | mac4n6 · iCloud Basics Storage and Acquisition of iCloud Data Synced Preferences Application Data

• Microsoft, Google, Dropbox, and other 3rd Party Apps! • Empty “Reserved for Future Use”?

Page 66: Sarah Edwards | @iamevltwin | oompa@csh.rit.edu | mac4n6 · iCloud Basics Storage and Acquisition of iCloud Data Synced Preferences Application Data

• iCloud Keychain: • OS X:

~/Library/Keychains/<GUID>/keychain-2.db (SQLite Database) • Accessible via User’s Login password

• iOS: /Library/Keychains/keychain-2.db (SQLite Database)

• iOS Backup – Encrypted iTunes Backup Only

• May contain passwords for – websites, WiFi, Application Accounts (Chat, Email, Apple), Web Form Data, Credit Cards, etc.

Page 67: Sarah Edwards | @iamevltwin | oompa@csh.rit.edu | mac4n6 · iCloud Basics Storage and Acquisition of iCloud Data Synced Preferences Application Data

• iCloud Keychain – Access via OS X Keychain Access.app

Page 68: Sarah Edwards | @iamevltwin | oompa@csh.rit.edu | mac4n6 · iCloud Basics Storage and Acquisition of iCloud Data Synced Preferences Application Data

• Expect more data to be stored in the iCloud • Many iCloud related directories empty…but for how long?

• More 3rd Party Application Data • Expect changes to directory structure and on-disk related

data

• Thank You for Coming! • Slides are available at mac4n6.com • Contact Me!

• [email protected]

• @iamevltwin

• mac4n6.com

• ***All icons are owned and are the copyright of Apple, Inc.


Related Documents
iCloud Keychain Sector2017 · BREAKING THE ICLOUD KEYCHAIN More iCloud data • Account information • iCloud storage information • Contact information (billing/shipping address,

iCloud Keychain Sector2017 · BREAKING THE ICLOUD KEYCHAIN....

Category: Documents
iCloud Keychain Sector2017 - SecTor 2018 - Security ... · BREAKING THE ICLOUD KEYCHAIN More iCloud data • Account information • iCloud storage information • Contact information

iCloud Keychain Sector2017 - SecTor 2018 - Security ... ·....

Category: Documents
Apple iCloud

Apple iCloud

Category: Technology
Icloud v Apple - Azd

Icloud v Apple - Azd

Category: Documents
Aiuto iCloud Prima di poter utilizzare iCloud, devi ... · PDF fileAiuto iCloud Aiuto iCloud Nozioni di base su iCloud iCloud memorizza musica, foto, applicazioni, contatti, calendari

Aiuto iCloud Prima di poter utilizzare iCloud, devi ... ·.....

Category: Documents
iCloud by Apple

iCloud by Apple

Category: Technology
Introduzione ad iCloud

Introduzione ad iCloud

Category: Technology
iCloud Help_ More Resources

iCloud Help_ More Resources

Category: Documents
ICloud UserGuide

ICloud UserGuide

Category: Documents
Aiuto iCloud Prima di poter utilizzare iCloud, devi

Aiuto iCloud Prima di poter utilizzare iCloud, devi

Category: Documents
Sarah Edwards | @iamevltwin | oompa@csh.rit.edu | …...Email: Apple ID Numeric: iCloud “Person ID” Vetted Account Aliases Email Addresses Phone Numbers Credentials Password Two-factor

Sarah Edwards | @iamevltwin | [email protected] |...

Category: Documents
Harrington iCloud Presentation

Harrington iCloud Presentation

Category: Documents