What should I preserve from the lock screen?¶

A lock screen can contain useful evidence even when the device itself cannot be accessed.

What this means¶

The first priority is to preserve what is visible before it changes.

Also record the wallpaper, emergency information, owner details, medical ID, missed-call indicators, alarm settings and any message previews.

These details may help identify the device, establish its state, show which services were active or reveal links to accounts and contacts.

But a lock screen is not a complete or reliable record of the underlying activity.

A notification may be delayed, duplicated, generated automatically or synchronised from another device. A sender name may come from the handset’s contact list rather than from a verified identity. A displayed time may reflect the device clock rather than the true event time.

Photograph the screen where lawful and appropriate. Include the whole device and, where useful, a closer image of the visible details.

Also note whether the device is connected to a charger, vehicle, headphones, smartwatch or other accessory. Those links may matter later.

The operational takeaway is: preserve the lock screen as a snapshot of the device’s visible state. Record it accurately, avoid opening anything and corroborate what it shows with underlying device, account or provider records.

What to check or do next¶

• Record the date and time shown on the device, the battery level, signal strength, mobile-network name, Wi-Fi status, Bluetooth status and any visible notifications.
• Do not start tapping notifications, swiping through screens or pressing buttons merely to reveal more. That may mark content as read, change the display, trigger synchronisation or alter evidence.
• If the screen is likely to turn off, record what is visible promptly and seek specialist advice before interacting further.