Extract from Asaf Horovitz’s article, “Can You Tell if a Device was Picked Up? iOS Device Orientation Tracking in Forensics.”
In many investigations, understanding how a device was used can be just as important as what was accessed.
Artifacts like app usage, screen activity and network connections provide valuable insight, but they don’t always tell the full story. Especially in cases where a device is locked, idle or intentionally kept inactive.
Can we determine if an iOS device was physically handled, even when the screen was off?
By leveraging iOS Unified Logs, we can reconstruct physical device orientation over time, providing a new layer of behavioral insight.
