Home/Services/iPhone Forensics
iPhone Forensic Expert Witness
Expert analysis and testimony involving iOS devices — acquisition method, encryption and device state, iOS databases, and the interpretation of Apple artifacts.
⚖︎Led by Daniel B. Garrie, Esq. — Founder, Law & Forensics · Neutral, JAMS · Faculty, Harvard · retained or court-appointed in 100+ disputes. Same-day conflict checks on most new matters, capacity permitting.
iOS Evidence
What we examine on iPhone and iPad
iOS is tightly integrated with iCloud and encrypted by default. Interpreting its artifacts requires understanding both the device and the ecosystem.
Acquisition method
Logical, file system, and physical extraction distinctions and what each can reach.
Device state
Locked, encrypted, jailbroken, or altered — and the effect on what was obtainable.
Messages & chat.db
iMessage/SMS databases, attachments, and edited/unsent-message behavior.
iCloud vs. local
Distinguishing on-device data from synchronized cloud content.
Significant Locations
Apple location history and what it does — and does not — establish.
App artifacts
Third-party app databases, caches, and their interpretation.
Backups
iTunes/Finder and iCloud backups as independent evidentiary sources.
Timestamps
Time-zone normalization across iOS sources and reports.
Health, photos & metadata
EXIF, media provenance, and ancillary artifacts in context.
Interpretation
The same iOS artifact can mean different things
An entry in an iOS database may reflect user action, a system process, a sync event, or application behavior. Reliable opinions identify which — and acknowledge when the artifact cannot tell them apart.
From Our Insights
Related reading
FAQ
Frequently asked questions
Can you recover deleted iMessages from an iPhone?
Sometimes — it depends on the iOS version, encryption and device state, the acquisition method, and whether the data persists locally, in a backup, or in iCloud. Recovery is fact-dependent and not guaranteed.
What is the difference between iCloud and on-device iPhone data?
Data can live on the device, in iCloud, or both, and the two are not always identical. Distinguishing local data from synced cloud data is critical to attributing an artifact correctly.
Does Apple Significant Locations prove where someone was?
It can indicate location patterns, but with important limits on precision, accuracy, and what user activity it reflects. It should be interpreted alongside other evidence rather than treated as conclusive on its own.
Get Expert Help With iPhone Evidence
iPhone evidence in dispute?
From extraction review to testimony, we interpret iOS evidence in its proper legal context.
Submitting a request does not create an attorney-client, expert, or consulting relationship. Do not send privileged or confidential materials until a conflict check is complete and an engagement agreement is in place.