Could leaving a device connected cause evidence to change?¶

Yes. A connected mobile device can continue changing even when nobody touches it.

What this means¶

Messages may arrive. Apps may synchronise. Notifications may update. Cloud services may add, modify or remove content. Location and usage records may continue to be created.

Another person may also act remotely.

They may delete messages, sign out accounts, change passwords, revoke trusted-device access, trigger a remote lock or wipe, or alter cloud-stored material.

The device may connect automatically to known Wi-Fi networks, Bluetooth devices, vehicles or accessories. That can create new records and expose its location or status to other systems.

Those actions also alter evidence and may cause an unlocked or decrypted opportunity to be lost.

Then consider the realistic threats.

Is there evidence of remote management? Is another suspect aware of the seizure? Is the device actively receiving content? Is it linked to cloud accounts or other devices? Is specialist support available?

Any decision to isolate, maintain connectivity or power the device should be documented with the reason.

The operational takeaway is: a connected phone is not static. Preserve its observed state, assess the risk of background and remote changes, and make a recorded decision about connectivity rather than assuming that doing nothing leaves the evidence untouched.

What to check or do next¶

• Start by recording the device as found. Note the time, battery level, connection status, visible notifications, open application and whether the device is locked or unlocked.

Evidential limits¶

Background activity is normal. It does not necessarily mean somebody is deliberately interfering with evidence.

But it means the state of the device at seizure may not remain unchanged.

This does not mean every connected device should immediately be switched off or placed into airplane mode.