Apple Stolen Device Protection

Overview

As part of recent iOS updates, Apple has introduced a security feature called Stolen Device Protection. While this feature significantly enhances the protection of personal data, it also limits the ability to perform authorized forensic acquisitions without direct user intervention.

If Stolen Device Protection is enabled, the device enforces a security delay (up to one hour or longer) and may prevent access to key data even if the correct passcode is entered. This setting can interfere with lawful forensic procedures and may cause delays or render the device inaccessible during the imaging process.

To avoid disruption of the forensic examination, the device owner must disable Stolen Device Protection prior to any forensic analysis.

Instructions to Disable Stolen Device Protection (iOS 17.3 or later)

IMPORTANT: This can only be done by the device owner, when the device is in a familiar location (home or work Wi-Fi, or similar recognized location). If not, Apple may require a delay before changes take effect.

Steps to Disable:

Unlock the device using Face ID, Touch ID, or passcode.
Open the Settings app.
Tap Face ID & Passcode (or Touch ID & Passcode, depending on device model).
Enter the device passcode when prompted.
Scroll down and tap Stolen Device Protection.
Tap Turn Off Protection.
Confirm by following the on-screen prompts.
The device may require biometric authentication (Face ID/Touch ID) and/or a security delay before the setting is fully disabled.

Note: If the device is not in a familiar location, Apple may require the change to be re-attempted after a security delay of up to 1 hour.

Why This Is Required

Forensic tools must access portions of the device’s data that may be restricted by Stolen Device Protection. If this feature is not turned off, the acquisition may be: