What should I do first when I encounter an unlocked phone?¶

An unlocked phone may present a brief opportunity to preserve visible evidence before the device locks, changes or reconnects.

Evidential caution: that an unlocked phone should be searched immediately. Access does not remove the need for lawful authority, proportionality or careful preservation.

What this means¶

First, record the phone as found. Photograph the whole device, screen, visible application, account, time, battery and connection indicators.

Avoid swiping, opening applications, scrolling or checking settings simply because the screen is available. Those actions may create records, mark content as read or trigger synchronisation.

Consider the risk of the screen locking. Do not press buttons, close covers or allow avoidable power loss.

Consider the risk of remote access or wiping, but do not isolate automatically without recording the current state and understanding the likely effect.

What to check or do next¶

• Note whether messages, calls, maps, cloud services, security prompts or remote-access indicators are visible.
• If a charger is needed, remember that cables and ports may carry data as well as power.
• Record visible notifications without opening them, and note whether new ones arrive after the first observation.
• Do not ask the user to demonstrate content or navigate through the phone unless there is a clear lawful and operational reason.
• Seek specialist advice quickly where the phone is encrypted, evidentially significant or likely to lock.
• Record every unavoidable interaction, including what was touched, why and what changed. Preserve the surrounding scene as well, including chargers, cases, paired devices and any nearby account information.