I'm a web developer and generalist programmer with a bit of mobile experience.
A friend of my wife is being stalked by a guy she was dating briefly and dumped over a month ago. He has somehow (not to say this is hard as I'm now learning) managed to compromise her iPhone. He recently let her know he knew who she was talking to over dating sites and other social media she accessed via the phone and claims he has a number of passwords etc...
I think I've got the damage-control side of things covered in terms of getting her to stop using her own personal devices and reset all her accounts on a friends computer and switch to a new email account for resets/verification, as well as redoing any security questions to not be facebook/asking-friends-answerable, etc.
But before I get her files backed up and do the phone factory reset after looking into all the places things might be able hide that resets don't touch (topic of another question), I'm wondering if there's a way to preserve the state of the phone in some sort of tamper-proof encrypted image that would suffice for evidence or at least good solid lead-building for purposes of law enforcement solutions to the problem in case he turns out to be a complete psycho and won't leave her alone once we've established that she has friends that are more technical than he is, one of them is often in the same sector that he's in, and has shared mutual acquaintances on LinkedIn (oopsie).
Is this possible/practical/admissible? If not, is there anything from this phone I should try to preserve before nuking it? Getting her safe in the short term is higher priority than him sorry but I'd hate to blow any opportunities to get his heirlooms in a vice later should that become necessary. I do not yet know how he communicated these things to her. I'm very hopeful it's email but he's probably smarter than that.