Test the Claim Against the Record

Claim investigation turns on a simple gap: a claim is a narrative told after the fact, while a phone is a contemporaneous record made as events happened. When a claimed period of incapacity, a reported loss or a stated whereabouts can be checked against what a device actually logged, the objective account is what an investigator wants in hand. The obstacle has been cost. Full forensic suites are priced for labs at thousands of dollars a year, which a special-investigations unit cannot spread across the volume of files it handles.

Sherlock Forensics iPhone Analyzer removes that barrier. For a one-time $599, with a free edition that opens the evidence first, an investigator can reconstruct a device they are authorized to examine and test the claim against it in house. The point is not to assume fraud; it is to replace assumption with the record, so a claim that holds up is confirmed and one that does not is documented properly.

The strength of an iPhone in a claim file is that several independent records converge on the same timeline. Sherlock reconstructs locations, Apple Health activity, photos with their capture metadata and messages, then merges them into one Activity Timeline aligned to the dates a claim turns on. A claimed inability to walk read against a Health step count and workout routes, a reported theft read against photos of the item after the claimed date, a stated location read against the device's own location record: each is a comparison the timeline makes visible at a glance.

Photo metadata is often the quiet decider. An image carries the time it was taken and, where location services were on, the place, so a photograph can anchor an object or a person to a moment that a narrative places elsewhere. Global search pulls every reference to a name, a place or a date across the whole device, so the pieces that bear on a claim gather in one view rather than being chased file by file. Where a message or a photo was deleted, Sherlock carves what the freed pages still hold and flags it as recovered.

An objective record only helps if it is obtained and read properly, so two lines hold throughout. The first is access. Sherlock analyzes a device you are authorized to examine, through the claimant's consent or a legal process, together with a device that can be unlocked. It does not unlock a locked device, does not defeat a passcode and does not reach a phone remotely or covertly. It is not a way to examine a device you have no authority over.

The second line is how the evidence is weighed. Device activity attributes to the device, not automatically to a person. Health data records what the watch or phone logged, not who was wearing or carrying it, so it corroborates or contradicts a claim rather than proving intent on its own. Presented that way, honestly and with its limits stated, the record is far more persuasive than an overclaim would be, because it survives the scrutiny a contested claim invites.

A contested claim can end up in front of counsel or a court, so the output is documented for it: the court-ready HTML report carries case and evidence numbers, examiner identification, disclosed methodology, per-artifact SHA-256 hashing and an optional evidence-integrity manifest, with recovered records flagged throughout, the documentation practice set out in NIST Special Publication 800-101 Revision 1, Guidelines on Mobile Device Forensics. Analysis is 100 percent read-only; the evidence is never modified.

Built by CISSP, ISSAP and ISSMP certified examiners with 20 years of court-defensible practice. Admissibility depends on jurisdiction, authority and evidence handling; the report documents the record so a finding rests on it rather than on an investigator's say-so.

Sherlock reads an iPhone from evidence you are lawfully authorized to examine: a device you can unlock, an existing backup or a full-filesystem extraction produced under authority. It does not unlock a locked device, does not bypass a passcode and does not reach a phone remotely or covertly. Device activity attributes to the device, not to a person. Apple Health corroborates activity rather than proving who performed it. Data deleted long enough ago to be overwritten is gone. Sherlock reports what the acquired evidence carries and flags what it recovered, which is what an investigator can hand to counsel and defend.

Download the free edition, open a backup or extraction you are authorized to examine and test the claim against the record yourself. Unlock the full analysis and the court-ready report when the file calls for it: $599 one-time, no subscription.

Get Sherlock Forensics iPhone Analyzer

Related: Significant Locations forensics · Corporate insider threat analysis · The full parser list · Product page