How Family-Law Attorneys Can Pull Call History From a Client's iPhone Backup

Why the Backup, Not the Phone

The Phone app shows roughly the last 100 calls — useless for demonstrating a six-month pattern of denied contact. The complete record lives in databases the phone carries internally: every cellular and FaceTime call with timestamps, durations, direction, and answered/missed status, plus the full iMessage/SMS history. A local iPhone backup contains copies of both — the messages from any backup, and the call history only when the backup was encrypted, which is Apple's rule on recent iOS.

Backups also fit how firms actually work. You don't want custody of a client's phone, and the client doesn't want to surrender it. A backup is a folder of files: the client can make it at home, or in your conference room in about fifteen minutes.

Step 1: Have the Client Make an Encrypted Local Backup

1. Connect the iPhone to a Mac with a cable and open Finder.
2. Select the iPhone in the sidebar, choose “Back up all of the data on your iPhone to this Mac.”
3. Tick “Encrypt local backup” and have the client set a password — Apple writes the call history database only into encrypted backups, so an unencrypted backup yields messages and no call log. Collect that password separately from the backup, and warn the client that nobody can recover it if they forget it.
4. Click Back Up Now and wait for it to finish.

The backup lands in ~/Library/Application Support/MobileSync/Backup/. If the client does this on their own Mac, the whole folder can be copied to an external drive and brought in; if they do it on a firm machine, you're already done.

Step 2: Extract the Call History and Messages

Inside the backup, files are named by hash — the call history is a SQLite database (CallHistory.storedata) and messages live in sms.db. In an encrypted backup both are encrypted file by file, which adds a keybag-and-password step to any manual approach. If your firm has a technical resource, they can locate and query these manually. It's doable and it's tedious: Apple stores timestamps in its own epoch format, FaceTime and cellular calls are coded differently, and you still end up hand-formatting a document a judge can read.

Exhibit A's attorney tier automates exactly this: point it at the backup, supply the client's backup password when it asks, and it extracts calls and messages, lays the calls out on a color-coded calendar (connected, missed, declined — the pattern is the first thing the court sees), and exports a PDF with your court caption, cause number, exhibit number, and firm name on every page. Each client gets a separate local workspace, so one machine handles a caseload without commingling records. You can judge the output yourself from this sample attorney exhibit generated from demo data.

Step 3: Scope the Exhibit to the Motion

A full extraction is often more than the motion needs. Two practices keep the exhibit tight:

• Date-scope it.Filter to the period in dispute — the calendar, statistics, and message log should all cover exactly that window, so opposing counsel can't point at a mismatch between the summary numbers and the attached detail.
• Disclose what you omit. If irrelevant messages are excluded, the exhibit should say so on its face. (Exhibit A prints an exclusion count in the statistics block and on the optional declaration page.)

A Note on Confidentiality

Everything above happens on a Mac your firm controls. No upload, no processing vendor, no cloud copy — which also means there's no third-party processor to vet or disclose. When the matter closes, deleting the workspace and the backup deletes the data.

As always: this is a workflow guide, not legal advice, and admissibility is jurisdiction-specific — the declaration template Exhibit A produces is a fill-in your firm reviews, adapts, and signs.

FAQ

Does the client have to hand over their iPhone?

No — the backup folder, not the phone, is what you work from. A cable and fifteen minutes.

Do encrypted backups work?

Yes — and for call history they are required, since Apple writes the call history database only into encrypted backups. Have the client tick “Encrypt local backup” in Finder, set a password, and pass it to you separately from the backup. The decryption happens on your own machine. Delete the backup and the password once the exhibit is produced.

What about Android clients?

This workflow is iPhone-specific. For Android, carrier records (which include cellular calls and SMS metadata, but not internet-based calls) are the usual route.