Intruder Detection is optional and off by default. In Settings you turn it on and choose 3, 5, or 10 wrong pattern attempts. Once that limit is reached, ArkWarden takes a front-camera photo after each wrong attempt and stores it encrypted on this iPhone, outside your normal vault files. You review those photos in Settings.
Nothing is captured until you enable Intruder Detection and allow camera access.
You pick how many wrong pattern attempts must accumulate before photos begin.
Each photo is encrypted and kept on your iPhone. Captures are not part of a vault backup.
You turn it on once. After that, wrong pattern draws past your chosen limit leave an encrypted photo you can review later.
Open Settings and tap Intruder Detection. Flip the toggle on. The first time, iOS asks for camera access. If you decline, or later revoke access in iPhone Settings, ArkWarden cannot capture photos until camera access is restored.
Until you enable the feature, failed unlocks behave as they always have: the grid clears, attempts are counted toward lockout, and no photo is taken.
Under the toggle you pick when photos should start: after 3, 5, or 10 wrong pattern attempts. The default choice is 5. You can change it any time while the feature is on.
Once the count reaches your limit, ArkWarden takes a photo on that attempt and on every wrong attempt after it. Pattern lockout still applies after 10 failed attempts, so capture stops when the unlock screen locks for 15 minutes.
When someone draws a pattern that opens neither your main vault nor Wing, ArkWarden counts a wrong attempt. If Intruder Detection is on and the count has reached your limit, it briefly uses the front camera and stores an encrypted photo.
There is no camera picker and no capture screen on the lock screen. The person trying patterns does not get an in-app prompt. iOS may still show its system camera-in-use indicator while the session runs. That indicator is an iOS signal ArkWarden cannot hide.
Open Intruder Detection again to see Captured Photos. Tap a photo to view it, or select photos to delete them. Clearing the history removes the captures you choose. It does not turn the feature off, and it does not remove the Intruder key used for future captures.
Intruder Detection has to work on a wrong pattern, when your vault master key is not in memory and cannot be derived. The design follows from that constraint.
A wrong pattern never unwraps the master key that encrypts your ordinary files. That is intentional. So Intruder Detection uses its own random key, created when you enable the feature and stored in the iPhone Keychain as device-bound material. Each capture is written with AES-256-GCM under that Intruder key.
Captures have their own encrypted index. They do not appear in Photos, Videos, Documents, or Audio, and they are not mixed into folders. The only place to browse them is Settings, Intruder Detection. Your everyday vault stays the place for files you chose to import.
When you turn Intruder Detection off, ArkWarden stops taking new photos. Existing captures stay until you delete them. The Intruder key also stays, so turning the feature back on does not require a new setup. Only a full vault wipe removes the key and every capture together.
Optional iCloud Backup and file export cover your main vault and Wing. They do not include the Intruder Detection index or capture files. The Intruder key is bound to this iPhone and does not travel with a backup, so captures remain a record on the device where the wrong attempts happened.
Turn on Intruder Detection in Settings, choose 3, 5, or 10 wrong attempts, and keep an encrypted photo record on your iPhone. It stays off until you decide otherwise.
