If you obtain a backup from iCloud or iTunes,
it should not matter when it comes to parsing
the data in the tool.
Now, there are some exceptions.
If you reach out to Apple, and you get warrant data,
that should be loaded as warrant data into your tools.
But if it's just typical iCloud data,
I want to show you a good way to load this information.
If we go into our VM, I have Physical Analyzer open.
I'm going to go to File, Open Case.
Now this is where you're going to have some options under Add.
Under Add, if it's warrant, click Warrant Returns,
and load it accordingly.
But if not, you can go to Common Source, Backup,
and this is where you'll look, and you'll see iTunes.
You technically could load it as an iTunes backup,
but I have a better way I want to show you so you
can control the environment.
I'm going to say Open Advanced.
I want to start without a UFED extraction.
I'm going to select Device.
I'm going to choose Apple.
And I'm going to choose iCloud.
Select that.
Now, you're going to have multiple options here.
And from my experience, I'm going
to share with you what I think works the best.
So click Next.
If it's Apple production, you could load this.
But I also find it works better sometimes
loading it as Warrant Data by other tools,
I don't typically use.
What I use is Legacy Raw Format because, when you download
cloud data, you will see that you usually
have a parent container that has multiple snapshots
underneath it.
If you load the parent container like this,
it will parse all of them, so that's definitely
what I recommend.