I have found a mobile device — what should I record immediately?¶

When a mobile device is found, the first few minutes may affect what can later be understood or recovered.

What this means¶

Before changing anything, record the device as you found it.

Describe the device. Include the make, model if known, colour, case, visible damage, connected cables, fitted accessories and any obvious identifying marks.

Is it powered on or off?

Is the screen lit, locked or unlocked?

What is displayed?

Are notifications visible?

Is it connected to Wi-Fi, mobile data, Bluetooth, a charger, headphones, a vehicle or another device?

Is the battery level visible?

Photographs may be useful where lawful and appropriate, particularly for the screen, lock screen, connected equipment and physical condition. Avoid unnecessary interaction merely to obtain more detail.

Also record nearby items that may be linked, such as SIM packaging, chargers, smartwatches, tablets, written passcodes, phone boxes or account recovery information.

Where the device is unlocked, damaged, low on power, actively receiving data or at risk of remote wiping, seek specialist advice quickly.

The operational takeaway is: create a reliable record of the device, its state, surroundings and connections before taking action. That initial record may later explain what changed, what was preserved and what opportunities were available.

What to check or do next¶

• Note the date, time and exact location. Record who found it, who was present and whether anyone had been using or handling it.
• Record its state.
• If the screen shows time, date, signal strength, network name or other status information, record that too.
• Do not start opening apps, reading messages, pressing buttons or testing passcodes unless you are authorised and the action is part of an agreed process. Each interaction may alter logs, trigger synchronisation, change screen state or affect later examination.