According to the CEO of Russian hacking tool creator Elcomsoft, Apple is storing Safari histories in the iCloud going back more than a year, possibly much longer, even where the user has asked for them to be wiped from memory.
Elcomsoft chief Vladimir Katalov told FORBES that Apple kept a separate iCloud record, titled “tombstone,” in which deleted web visits were stored, ostensibly for syncing across devices. When Katalov took Elcomsoft’s Phone Breaker software to extract data from the linked iCloud account, he found “deleted” records going back a year.
“It’s unclear just how or why Apple is storing cleared browsing history for such a long period. It would appear to be a design issue rather than anything suspicious, and is likely to do with the syncing mechanism between iOS, Mac OS X and Apple servers,” Thomas Fox-Brewster writes for FORBES. “Consumer cloud services like iCloud, by their nature, require records of delete requests to remain accessible for stretches of time, as users may have devices turned off that need to come alive again before they can sync and remove the browsing history. The fact that Apple didn’t hide the deleted records indicated it wasn’t a purposeful data retention effort, but an oversight, according to the forensics expert.”
Effective encryption and a different design would help hide the information from both Apple and probing tools like Elcomsoft’s Phone Breaker, an iOS forensics told FORBES.
