Upon searching logs for the IP address, Apple investigators discovered a different iPad had connected from the same address at 8:10 a.m. on July 17, before the burglary took place, and again at 1:56 p.m. on July 20, after the break-in was reported to police. That iPad wasn't suspected stolen, but the iTunes account information gave investigators a lead.

Tied with information from AT&T U-verse about the Internet connection, investigators were led to an address in Alameda, on the east side of San Francisco Bay. At that address Kariem McFarlin, the suspect in the case, was paying for AT&T Internet service, according to investigators.

While police were building their case there was more activity on the stolen devices.

Over a five day period, Apple investigators recorded activity on McFarlin's iTunes account linked to the iPad that originally connected to restore its operating system, a second iPad stolen from the Jobs' home and an iMac computer that was also missing, according to police. One of the iPads later connected from a Comcast Internet connection in Alameda using a different iTunes account.

Investigators say they searched McFarlin's Facebook page and discovered their suspect and the owner of this new iTunes account were friends.