ZA Support · Johannesburg
Digital Evidence Preservation for Apple Devices
Evidence preservation starts before deleting software, resetting an account or repairing a device. ZA Support records the agreed purpose and device state, selects an appropriate collection method and documents what was done. The correct method depends on the device, authority and evidence required.
What to preserve first
Keep original messages, emails, relevant devices and available account records. Record when the event was noticed and any actions already taken. Screenshots can provide useful context, but may omit metadata and are not a substitute for originals where those are available.
Do not apply a blanket power-off rule
Powering off, unlocking, disconnecting or leaving a device online can each affect evidence. An unlocked device may hold information that is unavailable after shutdown. Active remote access creates a different risk. Obtain a case-specific handling instruction and record the decision.
Radio isolation and protected handling
Faraday bags and shielded enclosures can be used for radio isolation where appropriate. They must be selected and checked for the required signals and device configuration. Shielding is not automatically perfect; power, heat and battery depletion require planning.
Radio isolation does not decrypt a device, disable every security control or prove that collection is complete. Do not improvise a handling method and assume it preserved the original state.
Images, hashes and write protection
Where feasible, an acquisition is made with documented tools and settings, and working copies are separated from preserved material. Cryptographic hashes identify and compare the captured files or images. A matching hash supports integrity of that item; it does not prove lawful collection or the truth of its contents.
Write-blocking is used where the storage and acquisition method support it. Integrated Apple storage, encryption and live acquisition can require different methods. Those choices and their limitations belong in the record.
Custody and controlled access
Record who received, transferred, examined or returned each item, with dates, times, identifiers, purpose and storage location. Limit access to authorised people. Agree retention, sharing and return or disposal instructions before closing the matter.
Technical report and legal review
The report identifies the instructions, sources, methods, findings and unresolved questions. ZA Support handles the technical work; qualified partners and legal practitioners support their agreed roles. Admissibility and evidential weight are for the court to determine. This page provides general process information, not advice on a particular legal matter.
Further reading
Indicative pricing only. Final pricing is confirmed once ZA Support verifies your device model and serial number.
Pricing is confirmed on assessment and depends on your specific device. Contact ZA Support on 064 529 5863 with your model and serial number for a confirmed quote.
Processing and lead times are indicative only and depend entirely on your specific machine.
The repair process and turnaround time change based on the model, the fault, and the parts your device needs. You will only have a confirmed lead time after you enquire and speak to a ZA Support consultant who assesses your machine. Contact us on 064 529 5863.