> ## Content Index
> Fetch the complete content index at: https://www.thelarsdaniel.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# Apple iPhone Preservation Guide
- URL: https://www.thelarsdaniel.com/apple-iphone-preservation-guide/
- Published: 2025-11-10T16:00:00.000Z
- Updated: 2026-08-11T13:05:44.000Z
- Description: This guide outlines best practices for preserving iPhone (iOS) devices after a collision to protect forensic data. Due to frequent software updates, steps may vary. Consult a cell phone forensic expert for up-to-date guidance. If any step cannot be…
- Author: Lars Daniel
- Tags: Cell Phone Forensics, Guides, #source-authory

This guide outlines best practices for preserving iPhone (iOS) devices after a collision to protect forensic data. Due to frequent software updates, steps may vary. Consult a cell phone forensic expert for up-to-date guidance. If any step cannot be completed, place the device in a Faraday bag (available online) to isolate it from radio signals.

## Preservation Checklist

\[ \] iCloud backup completed

\[ \] Credentials obtained and documented

\[ \] Airplane Mode enabled

\[ \] Wi-Fi disabled (via Settings, not Control Center)

\[ \] Bluetooth disabled

\[ \] SIM card removed (if applicable - not needed for iPhone 14+ in U.S.)

\[ \] Automatic updates disabled

\[ \] Stolen Device Protection disabled

\[ \] Device powered off

\[ \] Device and SIM card (if applicable) placed in Faraday bag

\[ \] Chain of custody documented

## 1\. Background

Preserving a device immediately after a collision is critical because:

- iPhones store perishable data (e.g., call logs, messages, app usage) in databases with overwrite periods of 7 to 30 days.
- These databases contain granular user interactions that may indicate whether device use contributed to the incident.
- Proper preservation prevents data alteration, remote wiping, or automatic updates that could hinder forensic analysis.

## 2\. Backing Up the Device

Backing up allows the client to preserve selected content (e.g., contacts, photos, settings) for transfer to a new device. **Do not factory reset or remote wipe the device, as this will destroy forensic evidence.**

**iCloud Backup Steps:**

- Navigate: Settings → \[Your Apple ID\] → iCloud → iCloud Backup
- Ensure "Back Up This iPhone" is toggled on
- Tap "Back Up Now"
- Wait for backup to complete

**Note:** iCloud backups may not include all forensically relevant data (e.g., system logs). Confirm backup completion before proceeding.

## 3\. Preservation Steps

Follow these steps to isolate the device from networks and prevent data alteration. Document all actions for the forensic examiner.

**3.1 Obtain Credentials**

- Request the client's PIN or passcode to unlock the device
- Document credentials securely for the forensic examiner
- Note: Biometric data (Face ID, Touch ID) cannot be used for forensic access

**3.2 Enable Airplane Mode**

- Navigate: Settings → Airplane Mode → Toggle ON

**3.3 Disable Wi-Fi**

- Navigate: Settings → Wi-Fi → Toggle OFF

**Important:** Disabling Wi-Fi via Control Center (swipe-down) is temporary and may auto-reconnect. You must use Settings for permanent disabling.

**3.4 Disable Bluetooth**

- Navigate: Settings → Bluetooth → Toggle OFF

**3.5 Remove SIM Card (If Applicable)**

Inspect the device's outer perimeter for a SIM tray

- If present, use a SIM card removal tool or paperclip to eject the SIM card
- Keep the SIM card with the device for submission to the forensic examiner

**Note:** iPhone 14 and later models in the U.S. use eSIM technology with no physical SIM card. Airplane Mode is sufficient for isolation in these cases.

**3.6 Disable Automatic Updates**

Preventing software updates ensures forensic tools can access the device, as updates may introduce new security features.

- Navigate: Settings → General → Software Update → Automatic Updates → Toggle OFF

**3.7 Disable Stolen Device Protection**

This feature may limit forensic access and should be disabled.

- Navigate: Settings → Face ID & Passcode → Stolen Device Protection → Toggle OFF

**Important:** If enabled, a 1-hour wait may be required to fully disable. Wait until the timer expires and confirm it shows "Off."

**3.8 Power Off the Device**

After completing all steps, power off the device to prevent further activity

- Press and hold the side button and a volume button, then slide to power off
- Place the powered-off device and SIM card (if applicable) in a Faraday bag for transport

## 4\. Chain of Custody

**Document the device's details:**

- iPhone model
- Serial number (Settings → General → About)
- Time of collection
- Custodian's name
- Maintain a secure chain of custody to ensure forensic admissibility
- Submit the device, SIM card (if applicable), credentials, and documentation to the forensic examiner

## 5\. Additional Resources

- Apple Support: www.apple.com/support
- Consult a forensic expert for device-specific guidance