Digital forensic practitioners face two key challenges when investigating Internet of Things devices. One is the need to reverse engineer a plethora of different devices and the other is the volatility of device data, including deleted data. This chapter attempts to address these challenges by focusing on the extraction of Internet of Things device data from the cloud by leveraging private application programming interfaces, an area that is relatively understudied in digital forensics. Specifically, this chapter presents the results of a study of decrypted traffic between six Android mobile apps (not the Internet of Things devices) and their respective cloud systems. The study results point to the feasibility of the approach and highlight the challenge involved in discovering additional application programming interface endpoints in a non-intrusive manner.