Published · Updated · By the Screen Trace team
Private photos, personal messages, notes you would rather keep to yourself. If you think someone went through your iPhone while you were asleep, away from your desk or having it repaired, start by checking the activity you can actually review.
Can you tell if someone used your iPhone?
You may find activity during a period when you were not using your phone. However, iPhone does not provide a universal “someone looked through your phone” history. A timestamp can help you review what happened; it cannot, by itself, identify a person or show which conversation or photo they viewed.
Start with these four sources. They answer different questions, so comparing them is more useful than relying on one unexplained entry.
| Method | Useful for | Main limitation |
|---|---|---|
| 1. App Privacy Report | Data, sensor and network access | Must already be enabled for the time in question |
| 2. Screen Time | App usage summaries | Not a complete list of individual actions |
| 3. Battery activity | On-screen and background activity | Background work is not evidence of someone reading your phone |
| 4. System diagnostic logs | Retained app and device-event timelines | Coverage and interpretation depend on the file |
Before checking, note the date, approximate time and time zone you are concerned about. Keep screenshots and original files so you can compare the sources later.
Method 1: Check App Privacy Report
Open Settings → Privacy & Security → App Privacy Report.
If it was already enabled, review the apps and access times under Data & Sensor Access. The report covers recent access to resources such as the camera, microphone, location and Photos, along with app and website network activity.
Apple describes a seven-day window. If the feature is off, turning it on starts collection from that point; it does not reveal earlier activity.
How to interpret it: an unexpected access time is something to investigate, not proof of snooping. A Photos permission entry does not identify a particular picture, and a contacted domain does not establish that personal files were sent.
Built-in feature reference: Apple — About App Privacy Report.
Method 2: Review Screen Time
Open Settings → Screen Time → See All App & Website Activity. Labels can vary between iOS versions.
- Choose the day you want to review.
- Look at the app usage summary and activity graph.
- Open a relevant app entry for the available breakdown.
- If multiple devices are included, use the device selector to choose this iPhone.
This is a useful starting point when your question is, “Was a particular app used around that time?” Collection needs to have been enabled for the period you want to review.
How to interpret it: a daily total or hourly bar is a summary. It does not show every tap, every opening and closing, or which messages were read. Compare the time with your own known use before drawing a conclusion.
Built-in feature reference: Apple — Get started with Screen Time on iPhone.
Method 3: Check Battery activity
Open Settings → Battery.
- Find the available usage graph and app breakdown.
- On newer layouts, tap View All Battery Usage and select a day. On older layouts, select a time range or graph segment and use Show Activity where available.
- Review the app’s on-screen and background activity, where shown.
The labels and available history depend on your iOS version. Use the range displayed on your own device.
How to interpret it: background activity can come from syncing, audio playback, location services or other ordinary tasks. Battery drain or a background entry alone does not mean someone unlocked the iPhone. On-screen activity is another clue to compare with the period you are reviewing.
Built-in feature reference: Apple — Check battery usage on your iPhone.
Method 4: Review retained system diagnostic logs
If the first three methods leave questions, a system diagnostic archive may contain additional app and device-event records. These files are primarily troubleshooting resources, not a complete recording of everything done on a phone.
When relevant records are retained and recognizable, they can help you put app activity, screen-lock or unlock indicators and supported AirDrop events in time order. There is no guaranteed three-day history or complete timeline for every iPhone. The result depends on the iOS version, collection time, system retention and the analysis tool.
How Screen Trace helps
Screen Trace is our iPhone app for organizing recognizable records from a diagnostic archive into a readable timeline and PDF report. It analyzes a file you choose on your own device.
- Look at the free sample first. Open the anonymous demonstration report in the app to see the report format.
- Follow the in-app file guide. Generate and save the full sysdiagnose archive. Keep the original archive intact.
- Import your file. Use the free format and readability check.
- Review the paid options. Choose the analysis scope and read the purchase terms before using a report credit.
- Review the report. Find your target period and compare the available events with the other sources.
Anonymous samples and file-format checks are free. Generating a report for your own file uses a paid report credit. A readable file does not guarantee that the date or event you want is present. The available sections also depend on the analysis option you choose.
Original diagnostic files and report content are processed locally rather than uploaded to our servers. Screen Trace does not reveal message text, typed passwords or a list of individual photos someone viewed.
Diagnostic collection resource: Apple Developer — Profiles and Logs. This describes Apple’s troubleshooting resources, not an endorsement of Screen Trace or its interpretations.
Put the records together before drawing a conclusion
Imagine you were away from your phone between 10:00 and 10:30 pm. You find an app usage summary in that period and a recognizable unlock indicator in a diagnostic report. That is a sequence worth reviewing, but it still does not establish who held the phone or what they read.
- Check the device and clock. Confirm the date, time zone and device behind each source. Do not apply an unexplained time offset just to make records line up.
- Check the event meaning. A generic app process event is not automatically a foreground opening. A screen-state change is not automatically a shutdown.
- Separate observation from explanation. Write “an app activity entry appears at this time,” rather than “this person read my messages.”
- Allow for missing records. No entry does not prove that nobody used the phone, particularly if it was already unlocked.
Similarly, opening a share sheet is not the same as completing a transfer. For AirDrop, direction and transfer status need their own interpretation. Read our guide to available AirDrop records.
Protect your privacy going forward
Reviewing history is only part of the picture. Check your passcode, Auto-Lock and notification-preview settings. If another person knows your passcode, consider changing it when it is safe for you to do so.
If the concern is shared account access rather than physical use of the phone, review your Apple Account devices and sharing settings. Where available, Apple’s Safety Check helps review current sharing and access. It is not a historical list of phone use.
Analyze your own device or files you have explicit permission to review. If a dispute or formal investigation is involved, preserve original files and describe what the records show separately from what you suspect.
Frequently asked questions
Can I see who unlocked my iPhone?
These activity sources do not provide a reliable identity for the person who operated the device. A lock or unlock indicator alone does not establish who was present.
Can I check whether someone read my WhatsApp, WeChat or Messages?
You may find relevant app activity, but that does not show which chat was opened or whether a particular message was read. Screen Trace does not recover chat contents.
Can I check earlier activity after installing Screen Trace?
Potentially, if the diagnostic archive still contains supported records from that time. Installing the app does not recreate deleted or overwritten data, and coverage cannot be promised in advance.
Does the app switcher prove which apps were opened?
No. App-switcher cards are not a timestamped history suitable for reconstructing every interaction.
Does an activity report prove my photos were leaked?
No. App usage, access permissions and network contact are different from proof that particular files were transferred. Any transfer claim needs supporting records and context.
See what a Screen Trace report looks like
This is the app’s built-in anonymous demonstration report, shown in Chinese. It illustrates the layout with example records; it is not a customer’s data or a promise of the same coverage for your device.
Open the anonymous sample screenshot (Chinese)
Explore Screen Trace
Preview the free anonymous sample before choosing a paid report. Free file checking verifies format and readability; it does not guarantee coverage of a particular date or event.