When I speak of "sessions" below, I mean CI Sessions, not PHP sessions.
If you use the default option (which the manual says should not be used for sensitive data) then the answer to your question is that it doesn't know. It trusts the cookie.
To use it in the designed secure manner, you should use the database session option, as well as the encryption option. Using both of these options this is the answer to your question:
Only one value is stored in the cookie. That value is a serialized and encrypted array. That array contains four pieces of information.
- 'session_id', => random hash
- 'ip_address' => 'string - user IP address'
- 'user_agent' => 'string - user agent data'
- 'last_activity' => timestamp
The session ID is a random string. This is the string that is used to correlate with the data in the session table. The string is regenerated (and re-encrypted) every request and updated in the cookie and the table. If this doesn't match the session table value, the table data is inaccessible and will be caught in the built-in garbage collection.
Optionally, you can also enforce IP checking in the CI session class. This means that in addition to a random regenerating session id, they users IP must also remain consistent or the session will be destroyed.
Optionally, you can also enforce UA checking, and a timeout value.
Therefore, a traditional session file is never written in a cache folder. CI Cookie sessions are worthless for all but non-personal data, such as remembering UI states of a web interface. CI Database sessions are very flexible. If your PHP install includes Mcrypt, the security is robust as well. If you do not have Mcrypt, they are still reasonably secure, but wouldn't pass muster on, for example, PCI compliance.
You can read more in the CI manual, but this was a summary of the info I thought most relevant to your question.