Should I leave an unlocked phone unlocked?¶

An unlocked phone may provide an evidential opportunity that disappears as soon as the device locks or restarts.

What this means¶

So the default should not be to press the power button, close applications or allow the device to sit unattended.

Every tap, swipe or opened app can alter evidence. It may create usage records, mark messages as read, trigger synchronisation, change timestamps, send acknowledgements or expose sensitive material outside the scope of the enquiry.

First, record the state exactly as found.

Then seek specialist support as quickly as possible.

Depending on the device and circumstances, a specialist may advise steps to maintain power, prevent automatic locking, manage connectivity or preserve the live state. Those steps should be deliberate, authorised and recorded.

Also consider operational security. An unlocked device may remain connected to accounts, remote-management systems or other people. Actions taken on it could alert users, alter cloud data or expose investigators.

The opportunity is valuable because an unlocked device may expose decrypted data, active sessions and accounts that become inaccessible after locking.

The operational takeaway is: preserve the unlocked state without browsing the device. Record what is visible, minimise interaction, maintain control of the device and obtain specialist advice before the opportunity is lost.

What to check or do next¶

• Note what is displayed, the time, battery level, connectivity, open application and any visible notifications. Photograph the screen where lawful and appropriate.
• Do not start guessing passcodes, changing settings, opening conversations or searching the device merely because access is available.
• If the battery is low, preserving power may be urgent, but connecting an unsuitable charger or moving the device without recording its setup may create other issues.

Evidential limits¶

But keeping it unlocked does not mean casually exploring it.