This guide explains why iPhone and iPad devices are challenging to acquire forensically and what determines whether data can be recovered.
Guide · 17 pages · 25 min read · Published 2026-09-02
Written specifically for UK lawyers, this reference addresses the legal and technical hurdles of acquiring evidence from encrypted iPhone and iPad devices that actively resist extraction. It explains why iOS security controls, such as passcodes, encrypted secure chips, attempt limits, auto-lock settings, and remote wipe capabilities, make mobile handsets uniquely difficult to open. Detailing the critical moments during handling at seizure, the text covers lock-state and passcode assessments, full chain of custody documentation, and the requirements for CPR Part 35 expert reports. Where direct device access is constrained by technical limitations, it maps out wider source architecture to locate counterpart evidence across iCloud backups, iTunes, Mac Finder, and paired computers. Legal practitioners receive strategic guidance on setting realistic expectations, recognising red flags, avoiding common mistakes, and drafting precise interrogatories or instructions for clients, opponents, and e-discovery providers. By combining practical checklists with specialist laboratory insights, it prepares legal teams to preserve high-value digital evidence effectively and maintain complete chain of custody during litigation.
Read this guide on your phone, open the PDF reader with the full text, browse guides by topic or go back to the full PDF library.
17 pages · 25 min read
Forensic acquisition of iPhone and iPad devices presents significant challenges due to encryption and security features.
Published by Computer Forensics Lab on 2026-09-02. Original material of the practice, free to read, cite and download. The authority behind this subject is ACPO/NPCC Good Practice Guide for Digital Evidence, which you should read alongside this guide. See every guide's author and source.
Prefer a PDF that matches this page exactly? Download the current text as a PDF, generated from the current wording of the guide, including any later corrections.
IPHONE & IPADFORENSICS · A GUIDE FOR UK LAWYERS iPhone and iPad Forensics: The Acquisition Challenge Why the Phone in the Evidence Bag Is the Hardest Device to Open, and What Decides Whether It Can Be COMPUTER FORENSICS LAB
§ ABOUT THE AUTHOR PREPARED BY COMPUTER FORENSICS LAB E-DISCOVERY TEAM LOCK-STATE & PASSCODE ASSESSMENT CPR PART 35 EXPERT REPORT S FULL CHAIN-OF-CUSTODY DOCUMENTATION
§ CONTENTS In this guide 01 Executive summary 02 The problem in plain English: the richest device, the hardest to open 03 Why iOS resists acquisition 04 The factors that decide what can be obtained 05 Handling at seizure: the decisive first moments 06 Setting realistic expectations honestly 07 Deployment: preservation, access and the estate 08 Source architecture: where else the evidence lives 09 Worked examples 10 Common mistakes and technical limitations 11 Questions to ask · Suggested wording 12 Checklist and red flags · When to involve a digital forensic expert 13 Frequently asked questions 14 Glossary · References · Disclaimer · How a specialist laboratory can assist
§ 01 · ORIENTATION Executive summary acquire, because everything is encrypted and passcode-bound and the phone actively resists extraction, so much can ever be recovered.
§ 02 · FIRST PRINCIPLES The problem in plain English: the richest device, the hardest to open
§ 03 · WHYIOSRESISTS Why iOS resists acquisition ENCRYPTED SECURE CHIP ATTEMPT LIMITS AUTO-LOCK REMOTE WIPE
§ 04 · THEDECIDINGFACTORS The factors that decide what can be obtained
§ 05 · HANDLINGATSEIZURE Handling at seizure: the decisive first moments
§ 06 · REALISTICEXPECTATIONS Setting realistic expectations honestly
§ 07 · DEPLOYMENT Deployment: preservation, access and the estate
§ 08 · THEWIDERMAP Source architecture: where else the evidence lives EVIDENCE I CLOUD BACKUP (ITUNES/ MAC / LOCKED/ THE COUNTERPART I PHONE DEVICES COMPUTER PAIRED IF DEVICE FINDER) IPAD WIPED
§ 09 · IN THE WILD Worked examples EXAMPLE1 · THEUNLOCKEDPHONETHATWASALLOWEDTOLOCK EXAMPLE2 · THEHONESTASSESSMENTTHATSETTHESTRATEGY EXAMPLE3 · THEPHONEWIPEDREMOTELYBEFOREEXAMINATION
§ 10 · WHEREITGOESWRONG Common mistakes and technical limitations Common mistakes Technical limitations
§ 11 · INTERROGATORIES & DRAFTING AIDS Questions to ask · Suggested wording Ask your client Ask your opponent Ask your e Discovery / forensic provider SUGGESTED WORDING · INSTRUCTIONFORANIOS AC QUISITIONASSESSMENT
§ 12 · QUICK CONTROL Checklist and red flags · When to involve a digital forensic expert The iOS acquisition checklist Red flags When to involve a digital forensic expert
§ 13 · COMMON QUESTIONS Frequently asked questions Can't you just plug the iPhone in and read it? What is the single most important thing at seizure? Why does the passcode matter so much? Can every iPhone be extracted? If the phone can't be opened, is the evidence lost? Someone might wipe the phone remotely. What do we do?
§ 14 · REFERENCE Glossary Sources and authoritative references DISCLAIMER
§ HOW A SPECIALIST LABORATORY CAN ASSIST Working with Computer Forensics Lab Speak to a forensic examiner, not a salesperson. INSTRUCTTHELAB NEWENQUIRIESEMAILE - DISCOVERY
74 pages · 101 min read
A UK-first practitioner handbook on electronic disclosure for solicitors, barristers, in-house counsel, paralegals, investigators and litigation support teams.
10 pages · 14 min read
A complete guide to how Computer Forensics Lab handles electronic evidence for UK litigation, internal investigations and regulatory work.
Whether you are responding to a regulator, preparing for disclosure, or scoping an internal investigation, start the chain of custody with a short, confidential conversation.
