What should I do if the phone is locked?¶

Preserve the locked phone in its current state, record what remains visible and avoid passcode attempts, restart or connectivity changes until the risks are assessed.

A locked device still exposes evidence¶

Record power, screen state, displayed time, battery, signal, networks, wallpaper, emergency details, notifications and connected accessories. Photograph the whole device and visible screen where authorised. These details may identify accounts, state and relationships even though protected content is inaccessible.

Avoid making access harder¶

Failed credentials can trigger delay, erase settings or other security responses. Restart may remove decrypted or volatile access and move the handset into a more protected state. SIM removal, charging and isolation also change the system.

Specialist options depend on model, operating-system version, security state and authority. Meanwhile, provider records, cloud accounts and linked devices may answer questions outside the handset. Notifications should be preserved without opening them.