Device acquisition
Backup, media, diagnostic, file-system or other supported methods selected according to the exact model, iOS version, device state, credentials and lawful access.
Apple mobile devices
iOS
Forensics.
Forensic acquisition and analysis of iPhone and iPad evidence, from communications and application activity to location, cloud and system artefacts.
Discuss a deviceExamination
What we can
establish.
Every instruction begins with the questions to be answered. Available evidence depends on the device, software, state, credentials, backups and prior handling.
Application evidence
Messages, email, browser activity, media, documents, keychain material where accessible and third-party application artefacts examined in context.
Location & activity
Available location, movement, connectivity, usage and system records correlated to reconstruct events.
iCloud & backups
Available backups and synchronised cloud material assessed alongside device data to extend or corroborate evidence.
Imported acquisitions
Compatible Apple backups, file-system images and third-party forensic exports assessed with their acquisition scope, hashes and provenance.
Database recovery
Active records, write-ahead logs, journals and residual database structures examined where application design, encryption and preservation allow.
Evidence source map
Beyond the
visible application.
Absence from one screen or device does not resolve the evidential question. Relevant records may be distributed across several sources.
Source device
Application databases, account state, system records, notifications, media and usage artefacts.
Cloud and backups
Configured device, application or account sources, subject to lawful authority, credentials, encryption, provider support and retention.
Linked computers
Desktop clients, browser sessions and synchronised endpoints where the application supports them.
Counterpart evidence
Recipient and group-participant devices, exports and attachments used to corroborate or challenge the source.
Evidential perspective
Encryption changes the route, not the question.
Modern Apple devices provide strong protection. Availability depends on model, software, lock state, credentials, configuration and current method support. A defensible examination states what was accessible, what may exist elsewhere and what the evidence cannot establish.
Preserve now
Protect the
best evidence.
- 01Do not reset, update, reinstall or casually browse the application.
- 02Record the device, lock, power and network state.
- 03Identify backups, linked computers and counterpart devices promptly.
- 04Secure known credentials separately and maintain custody records.
Typical deliverables
Acquisition record
Device details, condition, method, tool, integrity information and material acquisition limitations.
Evidence schedule
Relevant conversations, attachments, timestamps, identifiers and supporting artefacts in a reviewable form.
Findings report
Plain-English findings with source references, alternative explanations and express evidential limitations.
Our approach
Proportionate.
Documented.
Explainable.
- 01Authority, objectives and device state confirmed.
- 02Acquisition method selected to preserve the best available evidence.
- 03Findings correlated and tested against alternative explanations.
- 04Clear reporting of methodology, findings and limitations.
Sources and interpretation
Each entry identifies its limited supporting proposition and documentation-check date. General methodology is not a current device-support list. These checks are not laboratory validation; availability and method suitability require assessment for the exact source and configuration.
- Apple iCloud data protection
Configuration changes encryption and key availability.
Platform documentation · Documentation checked
- What iCloud backs up
Synchronised content and device backups are distinct.
Platform documentation · Documentation checked
- NIST mobile device forensics guidance
Methodological background (2014), not a current device-support list.
General methodology · Documentation checked
Confidential case review
