I have a case where it is claimed that the Iphone 5 was setup using a iCloud OTA backup of an Ipad2 back in 2012/13. The user's argument states that he had no knowledge of an email account setup in Mail used in the offence. He claims this was done by someone else using the iPad prior to him using a backup to setup his new iPhone 5. No iPad has been recovered.
I have examined the iPhone 5 (seized in 2013) but cannot find or determine if there is a PLIST showing the date and backup used to commission the phone.
My research from Apple Support disputes the knowledge element as no Keychain existed for OTA iCloud backups in iOS 6 (released iOS 7.0.3) and so the user would have been requested the password to activate the email account and sync with the third party server to download the email.
However, the use of iPad backups to iPhone is something I tried and failed back in iOS5 / 6 but from reading it appears it was possible. I obviously cant retest this as iCloud has evolved since this time and using devices running this iOS 6 is likely not to work as apple will demand the update.
Therefore I am seeking any opinion and links to any useful references for the following
1. PLIST of iPhone setup
2. Factors for an iOS backup to different iOS Devices relevant in 2012/13.
Thank you for any guidance and suggestions.
Kind regards
Rich