iCloud for iMessage Artifact

General (Technical, Procedural, Software, Hardware etc.)

Last Post by TrevorLahey 6 years ago

3 Posts

2 Users

0 Reactions

5,166 Views

RSS

TrevorLahey

(@trevorlahey)

New Member

Joined: 6 years ago

Posts: 2

Topic starter 30/07/2020 8:07 pm [#18623]

Hello everyone,

I was hoping that someone knew of an artifact that tells you if iCloud for iMessage is enabled or not on an iPhone. Would this artifact be apart of a standard logical extraction or would a full filesystem extraction be required?

Thanks for any help!

Quote

Topic Tags

lars

(@lars)

Eminent Member

Joined: 18 years ago

Posts: 31

05/08/2020 1:21 am

You want to look at:

private/var/mobile/Library/Preferences/com.apple.madrid.plist

which should be included in a logical extraction.

If the value for "CloudKitSyncingEnabled" is "True", then iCloud sync is on.

ReplyQuote

TrevorLahey

(@trevorlahey)

New Member

Joined: 6 years ago

Posts: 2

Topic starter 10/08/2020 10:47 pm

Thanks so much, lars. I tested this and did confirm it is apart of a logical extraction and that the CloudKitSyncingEnabled value is True when enabled.

Best,

ReplyQuote