What should I do first when I encounter a locked phone?¶

A locked phone may still provide useful evidence about its condition, connectivity and recent activity.

Evidential caution: that nothing useful can be done until the phone is unlocked. The lock screen may show time, network state, battery, notifications, emergency information or visible account context.

What this means¶

Consider remote wiping, incoming messages and battery loss, but do not apply a universal isolation rule.

Document any action taken and any change in state.

What to check or do next¶

• Record the phone as found. Photograph the front, back, screen, case, ports, cables and any damage.
• Capture the lock screen without opening notifications. Record visible signal, Wi-Fi, battery, charging, time and any message previews.
• Do not make repeated passcode or biometric attempts. Failed attempts may cause delays, lockouts or data-protection responses.
• Do not restart the phone to fix a problem. Restart may require the full passcode and remove live encryption access.
• If the device is charging, record how. If it is not, note the battery level where visible.
• Preserve nearby SIM packaging, chargers, paired devices or account information that may assist later enquiries.
• Record whether the phone was found with a person, in a vehicle, at a workplace or beside other devices, because that context may matter later.
• Do not insert a SIM, connect the phone to a computer or attempt account recovery as a first-response shortcut.
• Seek specialist support where the device is encrypted, damaged, managed or central to a serious investigation.