Mobile evidence guidance
Can data be recovered from a disabled iPhone?
Possibly. A disabled state is not the same as a wiped device. Feasibility depends on the iPhone model, iOS version, passcode knowledge, device condition, trust relationships and available backups.
Potential evidence sources
Where relevant records may exist.
- The disabled iPhone in its current state
- Trusted computer pairing records
- iCloud backups and synchronised data
- Encrypted Finder or iTunes backups
- Linked Apple devices
- Previously exported photographs or files
Decision factors
What materially changes the prospects.
- 01Exact model and iOS version
- 02Whether the passcode is known
- 03Whether erase-after-failed-attempts is enabled
- 04Existing trusted computers
- 05Backup availability
Evidential limitations
What must not be overstated.
Repeated passcode attempts can worsen the position
Updating or restoring through Finder or iTunes may destroy evidence
Not every disabled device can be acquired
Sources and interpretation
Each entry identifies its limited supporting proposition and documentation-check date. General methodology is not a current device-support list. These checks are not laboratory validation; availability and method suitability require assessment for the exact source and configuration.
- Apple iCloud data protection
Configuration changes encryption and key availability.
Platform documentation · Documentation checked
- What iCloud backs up
Synchronised content and device backups are distinct.
Platform documentation · Documentation checked
- NIST mobile device forensics guidance
Methodological background (2014), not a current device-support list.
General methodology · Documentation checked
Confidential case review
