Apple iPhone Preservation Guide

Lars Daniel

09 Nov 2025 — 3 min read

This guide outlines best practices for preserving iPhone (iOS) devices after a collision to protect forensic data. Due to frequent software updates, steps may vary. Consult a cell phone forensic expert for up-to-date guidance. If any step cannot be completed, place the device in a Faraday bag (available online) to isolate it from radio signals.

Preservation Checklist

[ ] iCloud backup completed

[ ] Credentials obtained and documented

[ ] Airplane Mode enabled

[ ] Wi-Fi disabled (via Settings, not Control Center)

[ ] Bluetooth disabled

[ ] SIM card removed (if applicable - not needed for iPhone 14+ in U.S.)

[ ] Automatic updates disabled

[ ] Stolen Device Protection disabled

[ ] Device powered off

[ ] Device and SIM card (if applicable) placed in Faraday bag

[ ] Chain of custody documented

1. Background

Preserving a device immediately after a collision is critical because:

iPhones store perishable data (e.g., call logs, messages, app usage) in databases with overwrite periods of 7 to 30 days.
These databases contain granular user interactions that may indicate whether device use contributed to the incident.
Proper preservation prevents data alteration, remote wiping, or automatic updates that could hinder forensic analysis.

2. Backing Up the Device

Backing up allows the client to preserve selected content (e.g., contacts, photos, settings) for transfer to a new device. Do not factory reset or remote wipe the device, as this will destroy forensic evidence.

iCloud Backup Steps:

Navigate: Settings → [Your Apple ID] → iCloud → iCloud Backup
Ensure "Back Up This iPhone" is toggled on
Tap "Back Up Now"
Wait for backup to complete

Note: iCloud backups may not include all forensically relevant data (e.g., system logs). Confirm backup completion before proceeding.

3. Preservation Steps

Follow these steps to isolate the device from networks and prevent data alteration. Document all actions for the forensic examiner.

3.1 Obtain Credentials

Request the client's PIN or passcode to unlock the device
Document credentials securely for the forensic examiner
Note: Biometric data (Face ID, Touch ID) cannot be used for forensic access

3.2 Enable Airplane Mode

Navigate: Settings → Airplane Mode → Toggle ON

3.3 Disable Wi-Fi

Navigate: Settings → Wi-Fi → Toggle OFF

Important: Disabling Wi-Fi via Control Center (swipe-down) is temporary and may auto-reconnect. You must use Settings for permanent disabling.

3.4 Disable Bluetooth

Navigate: Settings → Bluetooth → Toggle OFF

3.5 Remove SIM Card (If Applicable)

Inspect the device's outer perimeter for a SIM tray

If present, use a SIM card removal tool or paperclip to eject the SIM card
Keep the SIM card with the device for submission to the forensic examiner

Note: iPhone 14 and later models in the U.S. use eSIM technology with no physical SIM card. Airplane Mode is sufficient for isolation in these cases.

3.6 Disable Automatic Updates

Preventing software updates ensures forensic tools can access the device, as updates may introduce new security features.

Navigate: Settings → General → Software Update → Automatic Updates → Toggle OFF

3.7 Disable Stolen Device Protection

This feature may limit forensic access and should be disabled.

Navigate: Settings → Face ID & Passcode → Stolen Device Protection → Toggle OFF

Important: If enabled, a 1-hour wait may be required to fully disable. Wait until the timer expires and confirm it shows "Off."

3.8 Power Off the Device

After completing all steps, power off the device to prevent further activity

Press and hold the side button and a volume button, then slide to power off
Place the powered-off device and SIM card (if applicable) in a Faraday bag for transport

4. Chain of Custody

Document the device's details:

iPhone model
Serial number (Settings → General → About)
Time of collection
Custodian's name
Maintain a secure chain of custody to ensure forensic admissibility
Submit the device, SIM card (if applicable), credentials, and documentation to the forensic examiner