When should a mobile-device specialist be contacted immediately?¶

A mobile-device specialist should be contacted immediately when delay or incorrect handling could materially reduce access or evidence.

Why this matters¶

The dangerous assumption is that specialist support is only needed later for extraction. Some decisions made in the first minutes can determine whether evidence remains available.

What to record and do¶

Seek immediate help where the phone is unlocked, encrypted and likely to lock.

Escalate quickly where the battery is critically low, the device is remotely managed, remote wiping is credible or the correct isolation method is uncertain.

Immediate specialist input is also important where the device is badly damaged, wet, overheating or presents a battery hazard.

Contact a specialist where repeated unlock attempts have occurred, warnings are visible or biometric access may be lost.

The same applies where the phone is central to an active cyber incident, serious safeguarding risk, live threat or time-critical offence.

Before calling, record the phone as found. Capture the screen, power, battery, connectivity, notifications, cables and visible identifiers.

Provide a concise operational briefing: what the device is, how it was found, what is visible, what has changed and what decision is needed.

Do not simply say that the phone is “locked” or “technical”. Explain the live risks.

Where immediate safety requires action before help arrives, use the least destructive effective step and document why waiting was not reasonable.

Immediate advice is also appropriate where the phone is linked to a vehicle, wearable, cloud account or other device that may continue changing the evidence. Record any approaching screen timeout, incoming activity or loss of signal while awaiting support.

Operational takeaway¶

Escalate immediately when live access, battery, encryption, remote action, damage or urgent risk makes the next handling decision time-critical.