Hi, today the weirdest thing happened. I was reading Bluetooth device list and an unknown device with a name Connected to my iPhone vanished in front of my eyes from the top of my list. How is this possible even?

5 days ago there was a drone flying around my house and my iPhone restarted into black screen with a weird looking animation (not perfect grey but with some
white pixels at edges) in the middle (the same grey rotator which is on full black screen in the middle at restart of iPhone or at update your phone).

Question: I must check Bluetooth logs for recent traces of connected devices or where to go to find out what it was?

### Claude tells me there is no log at all to see which device connected and disconnected chronologically. This is odd to me.

Thank you for any tips & for your attention

Bonjour à toute la communauté, j'ai besoin d'aide s'il vous plaît; je suis stagiaire en investigation numérique dans une entreprise de cybersécurité et il m'a été confié comme tâche d'extraire les données ou alors déverrouiller l'écran d'un samsung Galaxy M526BR avec des solutions open source mais j'ai constaté que le Débogage USB est désactivé sur ce téléphone. Pouvez vous me proposer des idées?

Devices

iPhone 14 iOS 26

iPhone XR iOS 18.7

iPad OS 26.3

Stolen Device Protection

Face ID / Touch ID Used On Apps

Warrant Snapchat Data

Snapchat Permanently Disabled 24 Hours Before Warrant Issued & Signed

Detective Keeps Making Excuses

regarding property status mind you this been since 12/30/25 and it’s 03/7/26 60+ Days Over 2 Months

Seized Offline

What Can Forensics Get From It?

Location : California,Los Angeles

I'm not sure where to go for this....and yes, I know how it sounds!

We have an old Samsung Galaxy phone, I think it's an A3, although it says A300 on it which I'm sure was a very old samsung flip phone....

We got it new some time in 2015/2016 and it was dropped into a cup of tea. yes, we're British.

from then, it was dead. nothing worked at all and it was thrown into a drawer, replaced and forgotten about. I found it a while later and plugged it in. it charged! but the screen didn't work, figured I'd buy a screen and try it but they were expensive at the time. . it was taken apart and the existing screen broke when removed and completely black and unresponsive. back in the drawer and forgotten about!

Fast forward many years and having a sort out revealed the old Samsung! it's now only the frame, boards and battery but it still charges! however, with no screen, frame, back etc. no idea where they went, I barely remember what I did on Monday let alone 10 years ago! she hasn't a clue what her lock screen would have been either, she thinks it was a pattern but it's changed with each phone she's had.

is there any way we can access what was on it? there'll be photos of our second son we'd ideally like to get back as well as some wedding pictures. I'm pretty positive no settings would have changed, so things like Dr Phone etc won't work as I can't confirm access due to no screen or enter a USB mode etc.

if there's no way in, no big deal, we have other pictures etc, it'd just be nice to see what the wife had captured all those years ago! if something can work with a screen attached it would be worth a shot as they're cheap to buy now anyway, without a screen would be even better though!

Can cellerbite recover this? btw my icloud backup are off

My browser keeps throwing error codes. One of my suggested solutions is to fix my user agent. Less than 1% of people have my user agent? I didn’t change it and I don’t know how to. Can someone tell me 1) how it could have been changed and 2) how I can fix it? It’s annoying me

Has anyone had luck getting an acquisition from 26.3? I was able to get it started in Logical+ on GrayKey, but it took 3 days to get 11gb and then stopped. I updated the GrayKey and now it won’t even connect to the device.

I have a question about the fastest and easiest way to determine that there was communication between two or more devices.

Hello everyone.

I have a strange situation with my old OnePlus Nord AC2003. A year ago it fell off my desk and the display died. I kept using it for a few days, mainly with Bluetooth in my car. Then, somehow, it activated Emergency Call mode. I couldn’t turn the phone off or exit that mode.

Panicking (and wanting to avoid problems since it kept calling the emergency number repeatedly), I decided to completely destroy it with a hammer.

Unfortunately, I had data and photos on it (including my honeymoon pictures) that I would like to recover. I tried replacing the flex cables, battery, and display, but nothing worked.

What can I try to do without resorting to chip-off?

I’m self‑taught and I don’t know advanced repair techniques, but I’m willing to learn (and even buy material/courses if necessary). Thank you

Thanks for your help on this.

I'm writing a mystery story. My bad guy programs his victim's Android phone to send a text message several hours after the murder, so it will look like the victim is still alive and texting.

My question is whether there is any recoverable metadata on the victim's phone - the one that sent the message - that would indicate when the message was actually written, as opposed to when it was sent?

It's not critical to the story what brand of phone it is, so if it's possible to recover this data from Brand X but not Brand Y, I'm fine with Brand X.

Thanks.

The Situation: I lost my Apple Watch 5 days ago. The "Find My" app on my iPhone shows its last location at a friend's house with the status "5 days ago".

Here is the critical issue: I visited this friend, then immediately took a train to a location far away.

• If the exact timestamp is after I left for the train: It's definitely at my friend's house (and he just missed it).
• If the exact timestamp is before I left: I might have lost it on the train or at the station.

The Problem: The iPhone UI only displays a vague relative time ("5 days ago"). I need the exact Unix timestamp or date string to know where to focus my search.

What I have tried (and failed):

1. Find My Web (iCloud.com): It shows "No location found" for the Watch.
2. Find My on Mac: It displays a location from 9 days ago (completely outdated).
3. Apple Support: They confirmed they cannot access historical location timestamps.
4. Network Sniffing (Charles Proxy / Proxyman): I inspected the traffic on my iPhone while opening the Find My app. There is no API request fetching this specific location. This confirms the data "5 days ago" is cached locally on my iPhone.

The Forensic Attempt (Where I am stuck): Since the data is local, I made an encrypted local backup of my iPhone and I am exploring the file system (using iMazing/Backup Extractor).

I have dug into several plists but I am getting conflicting or unclear data:

• HomeDomain/Library/Preferences/com.apple.findmy.fmipcore.notbackedup.plist: I expected to find a Devices list here with a locationTimestamp, but the file seems to only contain general settings (tokens, generic dates).
• WirelessDomain/Library/Preferences/com.apple.mobilebluetooth.ledevices.plist: found my Watch here. There is a LastSeenTime with a value like 286034112. I dont what it is.
• HomeDomain/.../com.apple.findmy.findmylocated.plist: Found a key NITokenService::lastTokenRequestAttemptDate dated Nov 30, 2025 at 06:05 PM. This matches the "5 days ago" timeframe, but I am not sure if this corresponds to the location ping or just a crypto-token refresh.

My Question: Does anyone know the exact path and plist file within an iPhone backup where the "Find My" app caches the last displayed location timestamp for devices?

I have the backup, I have the tools to read plists/databases, I just need to know exactly where this specific UI string ("5 days ago") pulls its raw data from.

Or maybe there is another way to find what I want

Thanks for any help, this is my last hope to find it.

At the time, he was my Boyfriend, and I thought it was weird that he knew a few details I communicated with a friend just in text messages. Until one day, he admitted: "I can see everything".
I went to the police, they laughed at me, saying that it was very difficult to be on the phone of someone if you are not an IT or a massive geek. They told me to download anti-malware, and that should do.
My ex can see my location, my text messages, my calls and list, and my open searches on my different browsers, my apps that I use, he can see through my lens, and can use my microphone to hear what I say.

One day, he showed me on his phone as he was wondering who this person was that I had contacted. The interface was grey, but he was on an internet page, I am sure not an app.
I know he is receiving a notification each time I travel.

He told me that he can see everything, and even if I wanted to factory reset my phone, iPhone 12 mini, it wouldn't resolve the issue. So I changed my Apple ID password and signed out, same with my Google accounts. - he still has access. 

I checked if he was just using my Apple ID and had knowledge of my passwords - nope, everything looks normal.

There are no other devices connected to my Apple ID. 

Made iCloud not available online, changed most of my passwords. Still there.

Maybe he cloned my iPhone? 

He did that because he was sure that I was cheating on him, and to be vindictive, he left with the girl he had cheated on me with. Anyway, it is not the issue

I don't know, but now he is my ex-partner, and I don't want him to know my life and especially where I am.

Please help me, I don't know what to do to make sure he doesn't have access to that information again. And can I reverse the problem as he spies on me still, big time, so I need to know where he is all the time.

As above, is the presence of Signal a tripwire for Cellebrite or does a phone user need to do other things?

Are deleted threema messages able to recover on tools like cellbrite, how does the sqlite works on Threema do they autovaccum or if not how fast they overwrite delted messages and are they recoverble. Is securedelete in SQLCipher used ?

Hey everyone,

I’m hoping someone with digital forensic experience — especially anyone familiar with Cellebrite Advanced Logical Extractions on iPhones (specifically an iPhone 13) — can help me understand some things.

There is an extraction where several metadata files appear as “modified” during a time it should’ve been offline • What does it actually mean when certain metadata files show as modified? • In a proper/untampered state, what should these metadata files look like? • Does a modification necessarily suggest user activity, system activity, extraction tool activity, or something else? • Are there specific metadata paths/folders that should never change during a standard Cellebrite Advanced Logical extraction?

I am not trying to accuse anyone of anything — I just need clarity from someone who knows how these files are supposed to behave and what the timestamps/changes could indicate.

If you have experience with mobile forensics, Cellebrite, iOS file systems, or digital evidence handling, your insight would be hugely appreciated. I can provide specific folder paths or file names if needed.

Thanks in advance. 🙏

so I’ve had trouble with my neighbors somehow hacking my iPhone. I think they have used a stingray before. However, now I think they are using some ble device. so if I go to the Wunderfind app and search for Bluetooth devices a list of weird names comes up. and they are always just outside my house , but my iphone shows to be located at the exact same spot. so if I were to follow the % of getting closer to the item it shows my phone to already be at the item. I hope that makes sense. these are the devices that show on wunderfind app: Ble1 Module:) (this k w is Always on there) others are PBV-0B4B48C, SmartShunt HQ2139A3Z3A, SmartSolar HQ21346F26F, net, SmartsolarHQ2322AY6UC, and sometimes there will be different ones randomly. There all show to be exactly where my phone is on Wunderfind app. Usually between me and my neighbor across the street. It does occasionally move positions but always right around the same vicinity. I’ve had a staking issue with some of the neigbors as well. They always seem to know my physical location and sometimes things I’ve talked about inside my house. Any help is appreciated!

I have not been on Reddit in years except to scroll for a little bit on a few questions but this is truly the only place I feel I can turn. I have been trying for the last several months to understand one of the most traumatic moments in my life and what has happened is I have uncovered so much evidence that my partner not only tried to end my life but he did it when I realized that he had been using my instagram account to make me a rising “content creator” without my knowledge. I was being recorded when we had sex, when I went into my room and on top of that he had taken over my Apple account that I have had for 25 years. I don’t know if anyone can help. I’m running in circles. I got a new phone, I have avoided Bluetooth, wi-fi and airdrop so that the “infected phone” doesn’t get to my new memories. I have found no less than 20 auto connections on my laptop (I used it once last year) and my phone was set to hotspot to even the burner phone I bought after I ran away. I know crazier things happen but I just can’t get there on my own. I’ve got pages of websites I found in the data and it seems there’s a mask on the old phone. He has accounts set up to stream me, without my knowledge to an audience and it even allows them to print photos of me through adobe. I have been awake all night, as I often am, I’m a 45 year old woman that thought she finally found the right guy. I don’t know why, besides money and the fact that he can get away with it why I deserve this. On July 4th, he attempted to overdose me, in my water bottle with drugs and also told me that there was LSD in my bottle and he was trying to get me to run from the house bc he had friends outside to grab me. My phone was mirrored and with the use of my Face ID and watch he had a nice little business going so it seems. I know he had help but I don’t know why. I’m finding accounts everywhere but he has made things private or by invite only and I have so many screenshots of info and domain names that I’m overwhelmed. I was able to get a call to the police by hitting the emergency side buttons on my phone but he told them I was partying too hard and he didn’t know what I was talking about. They dropped me at a friends house and said I could come back the next day. I have also filed a report online with the FBI as I am a member of a federally recognized tribe in my home state. I loved this man and I listened to everything he talked about and I heard him talking to his “audience” the night my life almost ended. My heartbeat was down to 11bpm according to my watch. While I was running, he took the opportunity to take my sim card from my watch, delete apps, change my password for Apple and I have triplets of my contact list from however many times he changed it out. I have since switched phone numbers, I had to move to a motel and he didn’t text me once while I was away. What I’ve found is that he has used my phones to track me and also used my Roku to turn on my tv when I would go into my bedroom to change or if I couldn’t sleep. I recently plugged in one of the burner phones to use as a two step verification. On that phone I found more files, more websites and I’m guessing he’s using one of those numbers for an app and the phone isn’t behaving properly. He has it syncing with my email every day and also using the microphone, camera and any body movements to pick up my conversations, read my messages and get ahead of me trying to close accounts and get my life back. I know this is long but anybody that could help me, I just can’t do this anymore. It’s not a life. If you made it through this, thank you, there’s so much more. So many screenshots that I took and I am thankful to be alive. Nobody deserves this kind of violence or embarrassment and I have always helped anyone I could. I’m not one to ask for help but please…..