What happens to evidence when a device restarts?¶

A restart clears volatile state, closes applications and sessions and can require the main passcode before protected data is accessible again.

Opportunities can disappear¶

Memory contents and live encryption keys may be lost, biometric unlock disabled and an unlocked phone returned to a more protected state. Stored data usually remains, but access can become harder.

New activity can also begin¶

After boot, mobile, Wi-Fi and Bluetooth connections may resume. System checks, pending updates, application synchronisation and cloud activity can create logs and timestamps or expose the phone to remote commands.

Do not restart a live device merely to stabilise it, and do not power on one already off without assessment. If restart occurs through accident or battery loss, record exact circumstances and before-and-after state. External provider and cloud evidence may preserve activity no longer visible locally.