Published · Screen Trace team
Receiving a file, opening a share sheet and completing an outgoing transfer are different events. Existing files and retained system records may offer clues, but a complete AirDrop history is not guaranteed.
Start with existing files
Check Photos for relevant images. Other content may open or be saved in an app that supports it. Capture, creation, modification, import and transfer times mean different things; a single timestamp does not automatically identify an AirDrop receipt.
AirDrop receiving settings and contacts are not a complete transaction history. A device's display name alone does not identify its owner.
A sharing event is not necessarily a completed transfer
Apple's guide describes selecting content in a supporting app, opening Share and choosing an AirDrop recipient. A record of the share sheet, device discovery or connection setup alone does not establish successful delivery.
Photos is one way to initiate sharing. Foreground app timelines and transfer logs come from different sources and may cover different events. A missing Photos entry in one report does not by itself rule out sharing.
What might diagnostic records show?
If the system retained an event, the archive includes it and the parser recognizes it, AirDrop-related indicators may be available. Screen Trace checks diagnostic files you select and displays recognizable records when present. No tool can guarantee identical fields or a fixed retention period on every iPhone.
- Direction: establish whether this device sent or received; do not rely only on a peer name.
- Status: distinguish discovery, attempts, cancellation, failure and completion.
- Time: preserve original timestamps, time zones and record sources, with surrounding events.
- Content: names, types, counts or identifiers may be missing or redacted. A generic label does not identify a particular private photo.
Keep material that can be checked
- Note the date, period, device and time zone.
- Save any available original diagnostic archive promptly, keeping an unchanged copy.
- Retain original log entries, source paths and surrounding context during analysis.
- Redact unrelated personal details from shared reports and limit access to originals.
For a formal review, provide the original material to the reviewer rather than only a cropped screenshot or a statement that a transfer succeeded. This guide explains how to review records; it is not a determination about a specific incident.
How Screen Trace can help
Screen Trace checks a selected file and organizes recognizable AirDrop and device activity records for further review. Preview the anonymous sample and file-checking results before deciding to generate a paid report. Missing records do not rule out a transfer, and activity records alone do not identify an operator or prove which private content was disclosed.
References
Apple documents explain built-in features. Diagnostic analysis and product descriptions are our own guidance, not an Apple endorsement.
Explore Screen Trace
Check a selected diagnostic file locally and review the anonymous sample before deciding whether to generate a paid report.