The installation of iCloud Control Panel, other than allowing the recovery of the user's authentication token, as shown previously, leaves logs of interest within the disk of the computer.
On a Windows Vista/7/8 system, the logs of the connections to the iCloud service are stored in
C:\Users\<username>\AppData\Roaming\Apple Computer\Logs. To locate the logs of interest, it is necessary to search logs related to the executable
iCloud.exe file within the text file. The files are named according to a standard format that includes the date and time at which the service started (for example,
asl.113048_18Apr16.log), thus letting the analyst create a timeline of iCloud usage.
The user information configured ...