Legacy01
iPhone 6 — 8 / SE
Deep file-system extractions via checkm8 — the strongest recovery class still available on Apple hardware.
- checkm8
- Full FS
- Keychain
iPhone Forensics,
recovered defensibly.
We extract iPhones across the supported range — iMessage, deleted photos, location history, app data and iCloud — and produce reports that withstand cross-examination in Australian and NZ courts.
- Coverage
- iPhone 6 → 15 Pro Max
- Method
- AFU · BFU · iCloud
- Reports
- Hash-verified, court-ready
What We Examine
Every artefact iOS records,
Every artefact iOS records,
reconstructed in order.
iOS keeps far more than the user sees — message journals, deleted-row remnants, location pings, app caches and synced cloud copies. We work each one and reconcile them into a single timeline.
Layer01
iMessage & SMS
Active and deleted iMessage, SMS and MMS recovered from chat.db, including attachments, reactions and edited-message history.
Layer02
Photos & media
Camera roll, screenshots, deleted-recently and synced iCloud Photos — with original EXIF, timestamps and location metadata.
Layer03
Location history
Significant Locations, Frequent Locations, Maps history, Find My data and per-app location traces with timestamps.
Layer04
Third-party apps
WhatsApp, Signal, Telegram, Snapchat, TikTok, Tinder, Hinge — chats, contacts, media and call logs decoded.
Layer05
iCloud & backups
Lawful iCloud collection, encrypted iTunes backups and Mac sync data — full file-system where access permits.
Layer06
Usage & health
Screen Time, KnowledgeC, biome and Health database analysed for activity, presence and behavioural timeline.
Device Coverage
From iPhone 6 to 15 Pro Max,
From iPhone 6 to 15 Pro Max,
every generation handled.
Different iPhones unlock at different forensic depths. We tell you upfront what's realistically achievable for the model, iOS version and lock state in front of us.
Modern02
iPhone X — 13
AFU and BFU agent-based acquisition, with passcode brute-force on supported models where lawful.
- AFU
- BFU
- Agent
Current03
iPhone 14 — 15 Pro Max
Latest agent and cloud workflows for current iOS — including iCloud, iTunes backup and logical extraction paths.
- iOS 17/18
- Cloud
- Agent
Locked04
Locked & disabled
Where lawful: brute-force on supported models. Where not: cloud and backup paths to surface evidence.
- Lawful only
- Cloud path
- Backup
The Approach
Apple-grade hardware,
Apple-grade hardware,
court-grade practice.
Our iPhone work uses the same forensic platforms relied on by Australian law enforcement — agent-based acquisition, checkm8-class extractions, validated cloud collection and hash-verified imaging.
Every step is documented. Nothing is opened on a live device. The output is an exhibit pack a magistrate, judge or arbitrator can rely on.
Models
iPhone 6 → 15 PM
iOS
Through iOS 18
Apps
500+ decoded
Reports
Hash-verified
The Process
Calm, methodical,
Calm, methodical,
court-grade from intake.
Step01
Intake & scoping
Confidential brief, lawful authority confirmed, model and iOS version checked, fixed-fee quote provided.
Step02
Forensic acquisition
Agent, AFU/BFU or cloud collection in our lab. Hashes captured. Chain of custody opened.
Step03
Decode & analysis
SQLite, keychain and app stores parsed; deleted records carved; timeline reconciled across sources.
Step04
Court-ready report
Plain-English findings with annotated exhibits. Expert testimony available where required.
Frequently Asked
iPhone forensics, plainly explained.
Request A Consultation
Send A Brief.
Send A Brief.
We'll Take It From There.
Every enquiry is read by a licensed investigator and treated in strict confidence.
Step01
You send a brief
A short note about your matter — no detail required upfront.
Step02
We reply within one business day
From a licensed investigator, not a chatbot or call centre.
Step03
If we're the right fit, we book a call
Confidential. No obligation. Fixed-fee quote where possible.