What should I do if the phone is locked?¶

A locked phone may still be evidentially valuable, but the wrong action can make it harder to examine.

What this means¶

It may still display notifications, time, date, signal information, battery level, emergency details, wallpaper, connected accessories or other visible material. It may also remain connected to networks, cloud services and linked devices.

Failed attempts may trigger longer delays, erase settings or other security responses. Even where no automatic wiping occurs, repeated attempts create unnecessary risk and alter the device’s state.

A locked device may still be examined using specialist methods. The available options depend on the make, model, operating-system version, security settings, state of the device and lawful authority.

The operational takeaway is: preserve the locked device in the state found, record what is visible, avoid guessing or restarting, and seek specialist advice before taking any action that could reduce access or alter evidence.

What to check or do next¶

• Start by recording the state exactly as found.
• Note whether the device is powered on, whether the screen is lit, what is visible, the battery level, the network connection and any notifications. Photograph the screen where lawful and appropriate.
• Do not repeatedly guess the passcode.
• Do not restart or switch off the phone by default. A restart may move the device into a more strongly protected state and remove access to volatile or decrypted information.
• Do not remove the SIM, change connectivity or place the device on charge without considering the consequences and recording what you do.

Evidential limits¶

Do not assume that a locked device is useless.

Also consider evidence outside the handset. Provider records, app accounts, cloud backups, linked devices and network data may remain available even where the phone cannot be accessed immediately.