iCloud Backup Enabled?
Is there a way to determine (via an iTunes backup/image) if iCloud was setup/enabled on a device and when it was run? Using Oxygen Analyst and have access to the filesystem backup of the devices.
Cellebrite UFED Physical Analyzer has this supported
If iCloud was enabled on the device you will see extracted iCloud token in Passwords section in Oxygen Forensic Analyst and in Cloud Accounts section in Oxygen Forensic Detective software. In the Detective version, you will also be able to access iCloud storage with this token and extract all or selected data.