Someone went through my phone—what now?
Vault remaining private files, empty Recently Deleted, change the device passcode if safe to do so, and treat Screenshots as hostile territory until cleaned.
Contain
Move still-exposed private media to Blopman immediately.
Rotate
Passcodes, important account passwords if authentication screens were visible.
Hardening
Notification previews off when locked; separate vault secret; decoy if coercion is a concern.
FAQ
Should I confront with ‘proof’?
iOS rarely gives forensic proof. Focus on reducing future access.