What should I do first when I encounter an unlocked phone?¶

Preserve the visible unlocked state immediately, then minimise interaction while the power, locking and connectivity risks are assessed.

An unlocked phone can provide a temporary evidence opportunity, but unnecessary interaction can also change it quickly.

Capture the state before it changes¶

Photograph or record:

• whole phone;
• screen;
• visible application;
• account name if already displayed;
• time;
• battery;
• mobile/Wi-Fi indicators;
• prompts;
• notifications; and
• any visible messages, map or call state.

Preservation is not the same as searching¶

An unlocked display does not itself authorise a search.

Avoid unnecessary:

• scrolling;
• opening apps;
• checking settings;
• replying;
• marking content as read; or
• navigating through accounts.

Those actions can create records, synchronise data and alter application state.

Manage competing risks deliberately¶

The phone may lock automatically.

Battery may be low.

Remote access may still be possible.

Charging or isolation may each change the evidence.

When should a specialist make the power decision? and What is device isolation? cover those choices.

Record every unavoidable interaction¶

If you have to touch the device, record:

• action;
• reason;
• time;
• operator; and
• visible result.

Preserve nearby chargers, cases, paired devices and account information because they may help explain later device ownership or use.

The practical point is: an unlocked phone is a temporary state worth preserving, not an invitation to explore it casually.