When the browser history of Apple devices is cleared, it remains on iCloud for up to a year and can easily be recovered, according to research by security company Elcomsoft. This is possible because the history is hidden and not actually deleted.
"We discovered that deleting a browsing history record makes that record disappear from synced devices," Vladimir Katalov from Elcomsoft writes on the company's website. "The record still remains available (but invisible) in iCloud. We kept researching, and discovered that such deleted records can be kept in iCloud for more than a year."
The company sells Elcom Phone Breaker, a forensic tool that is able to retrieve iCloud backups. After its discovery Elcomsoft added a new ability to the application that makes it possible to retrieve deleted browsing history records from iCloud.
"Safari history is synced across devices. Once you delete a record on one device, it will disappear on all other devices in a matter of seconds (or minutes), provided that those devices are connected to the Internet," Katalov explains. "However, those same records will be kept in Apple iCloud for much longer. In fact, we were able to access records dated more than one year back. The user does not see those records and does not know they still exist on Apple servers."
Elcomsoft was able to retrieve browsing history records that were more than a year old but stresses that users shouldn't worry. If their iCloud account is properly secured with a strong password and two-factor authentication it should be impossible to gain access to their data.
