What should I do first when I encounter a locked phone?¶

Record the phone's visible state and context before attempting anything else.

A locked phone can still give you useful information about power, connectivity, notifications, condition and surrounding devices. What it does not give you is permission to improvise access.

A locked phone still has evidence around it¶

Record:

• front and back;
• case;
• ports and cables;
• damage;
• location found;
• visible time;
• battery;
• charging state;
• mobile/Wi-Fi indicators;
• notification previews; and
• nearby accessories or packaging.

Those observations can matter later even if the phone is never unlocked at the scene.

Do not turn preservation into guessing¶

Avoid:

• repeated passcode attempts;
• repeated biometric attempts;
• restart;
• improvised account recovery;
• inserting another SIM;
• connecting to an unknown computer; or
• asking several people to “have a go”.

Those actions can create delay, lockout, stronger security state or new records.

Power and connectivity still need decisions¶

A locked device may still be vulnerable to:

• battery loss;
• remote change;
• cloud synchronisation;
• network activity; or
• management commands.

That does not create a universal rule to isolate or charge it.

When should a specialist make the power decision? and What is device isolation? cover those choices.

Keep ownership separate from observation¶

A phone found beside someone, in their vehicle or at their desk may support a line of enquiry.

It does not by itself prove ownership, control or use.

The practical point is: treat the locked phone as a live evidence source with an observable state. Record first, avoid access attempts, and escalate before changing power or connectivity where the consequences are uncertain.