The REACT team reached out to Apple's own investigators, who had access to the company's computer systems, and supplied them with a list of serial numbers of stolen devices. Apple was quickly able to determine that one of the stolen iPads had connected with Apple's servers soon after the burglary.
The iPad was trying to reinstall its operating system and was recorded connecting from an AT&T U-verse Internet IP address from 7:22 a.m. to 7:31 a.m. on July 18, the morning after the house was broken into and minutes before the returning construction workers would discover the break-in.Upon searching logs for the IP address, Apple investigators discovered a different iPad had connected from the same address at 8:10 a.m. on July 17, before the burglary took place, and again at 1:56 p.m. on July 20, after the break-in was reported to police. That iPad wasn't suspected stolen, but the iTunes account information gave investigators a lead.

In a subsequent interview with McFarlin, police say he admitted breaking into the home by climbing over the builders' scaffolding and finding a spare key for the house in the garage. He said he stole two iMacs, three iPads, three iPods, one Apple TV, a diamond necklace and earrings, and several other items.
In explaining his actions, investigators say McFarlin said he had money problems and had taken to breaking into houses. He wrote a single page letter of apology admitting he had burglarized Steve Jobs' house and stolen property, but had done so because he was desperate.
More here: How Police Tracked Down Steve Jobs' Stolen iPads | PCWorld