How to Preserve AirTag Evidence? Preparation Guide for a Criminal Complaint
Learn how to preserve photos, scan records, the serial number, and the event chronology when a suspicious AirTag is found, even without a notification.
When you find a suspicious AirTag, your first reaction may be to throw the device away or break it. In near danger, stopping the tracking is of course the priority. But if your safety allows, keeping the context where the device was, the phone alerts if any, the scan record if not, and the identity details in an orderly way makes a legal application easier to understand. That no operating-system notification formed does not devalue the physical device or the other event records.
This guide is not a forensic-examination instruction. Rather than trying to analyze the evidence yourself, it aims for you to preserve its current state as much as possible and follow law-enforcement guidance.
Life safety first, then evidence
The person you suspect may be nearby, may have threatened you, or may act when they realize you found the device. If such a risk exists, do not examine it at the device. Move to a crowded, safe place, tell a trusted person, and in an emergency call 112.
Turning the device off can stop tracking updates, but it can suggest to the suspicious person that you found it. Leaving the device on can mean your location keeps being shared. This choice is not just technical but a safety decision. If possible, ask law enforcement for instant guidance.
Recording before removing the device
In safe conditions, take these photos:
- Wide shot showing the area where the device is.
- Medium shot showing the AirTag and the point where it was placed together.
- Close-ups showing the device’s front and back.
- The connection form if a magnetic box, tape, clamp, or another apparatus exists.
If it was in a car, link the car’s plate to the incident in your own record without publishing it online. If it was in a bag, note who had access to the bag that day. Keep the photos’ originals without cropping or filtering.
Do not lose the digital records
The alert on your phone can include this information:
- The tracking device’s type or name.
- The route where it was detected with you.
- First and last detection time.
- Play-sound or nearby-finding result.
- Device identifier or serial number.
Screenshot every screen. Google notes that previous tracker alerts on Android may be deleted after 48 hours. Turning alerts off can also clear past records. On iPhone too, the notification and map may not appear the same way later.
Copy the screenshots to a safe cloud account or a trusted person. Keep the originals while organizing the files; create a separate copy for the application.
How to get the AirTag serial number?
Hold your NFC-capable phone to the AirTag’s white face. The Apple page that opens may show the serial number and sometimes the last four digits of the phone number of the person who registered the device. Save the page’s screenshot and link.
The serial number is also printed under the battery. But opening the device or removing the battery changes how it works. If you can reach law enforcement shortly, ask how to hand it over before physical tampering. In near danger, do not hesitate to follow the manufacturer’s deactivation instructions.
How to prepare an event chronology?
A one-page table can be clearer than scattered screenshots. Write these headings on each row:
Date-time · Place · What happened? · Who was there? · What record exists? · Effect on safety
Also add events before the AirTag: persistent messages, waiting in front of the workplace, unexpected location knowledge, threats, old applications, and measure violations. Separate comment from fact. Instead of “They definitely followed me”, use concrete narration like “This person wrote in a message on 12 July a location only I knew; the screenshot is attached”.
How can you keep the physical device?
Unless law enforcement gives a different instruction, keep the device in a small bag or box without breaking or cleaning it and limiting others’ needless contact. Write the found date-time and place on a separate label; do not write directly on the device.
Note who saw or handled the device. This record does not create a professional chain of custody, but it reduces confusion. Opening the device on a social-media livestream, taking it to the person you think owns it, or having it reset at a technical service can cause information loss.
Act fast for camera footage
Apartment, parking-garage, workplace, or service cameras may delete recordings shortly. State in your application the camera, date, and time range where footage may exist. Do not try to forcibly take recordings yourself or access them without authorization; request that they be asked for through the prosecutor’s office or law enforcement.
When requesting footage from a private business, remember that personal-data rules exist. The business not giving it to you directly does not mean the footage does not exist.
The file to present to police, gendarmerie, or the prosecutor
In a simple folder, you can use this order:
- A one-page event summary and your safety concern.
- Chronology.
- Phone alerts and route images if any; if not, the BLE scan time, place, and target record.
- Photos of where the device was.
- Serial number and NFC page.
- Message, call, and other following records.
- Witness and camera details.
- Previous application and measure decision numbers.
Get your application’s registration or investigation number. If the physical device is handed over, ask for a handover report or receipt record.
Do not produce unlawful evidence
Do not try to enter the suspected person’s phone, email account, or Apple account. Installing spyware, seizing a password, or systematically recording private conversations can create separate legal problems. Preserve your legitimate records and request that needed information be asked for by the competent authorities.
Application and support paths
In urgent risk 112; for complaints the police, gendarmerie, or Chief Public Prosecutor’s Office; for protective measures the Family Court and institutions under 6284 can be considered. ŞÖNİM and ALO 183 provide guidance. If you cannot reach a lawyer, learn the application conditions of the bar’s legal-aid office.
Official sources
Search without waiting for an alert
Narrow down the suspicious Bluetooth signal step by step.
AntiAirtag detectors show active BLE broadcasts with a strong antenna even when your phone produces no alert, and help you approach the source of the signal you select. They cannot by themselves confirm that a broadcast is an AirTag or a malicious device.
Compare AirTag detectors