What might be stored in an iCloud or Google backup?¶

An iCloud or Google backup may contain a selected copy of data and settings from a mobile device.

What this means¶

That can include messages, contacts, call history, photographs, application data, device settings, account information and configuration details.

But the exact content depends on the device, operating system, account settings, app design and backup type.

Some material may be backed up as part of the device backup.

Other material may synchronise separately.

Photographs, contacts, calendars and notes may sit in dedicated cloud services rather than inside the backup itself.

Some apps exclude their data from backups or store only limited information.

End-to-end encrypted services may also treat content differently.

The backup date is critical.

A backup shows the device or account at a particular point in time.

Deleted material may remain in an older backup.

A restored backup may also place old content onto a new handset, making it appear as though that device created or originally held the material.

Cloud-synchronised data, provider records and linked-device evidence may need to be considered separately.

Where lawful and appropriate, preserve the account and relevant backup records early because availability may change.

The operational takeaway is: iCloud and Google backups may contain valuable snapshots of device data, but they are selective and time-dependent. Establish what was backed up, when, from which device and whether it was later restored.

What to check or do next¶

• Investigators should identify the account, source device, backup date, backup size and restore history.

Evidential limits¶

Recent activity may not appear if the backup had not run.

Do not assume that a backup contains everything or that every item came from the currently seized device.