What is the difference between a device being locked, encrypted and powered off?¶

Locked, encrypted and powered off describe different conditions.

What this means¶

A locked device is powered on but requires an unlock method before normal access is available.

It may still receive messages, connect to networks, run applications and display notifications.

Modern phones are usually encrypted whether the screen is locked or unlocked.

The unlock process helps make protected data available to the operating system and applications.

A powered-off device is not running.

These conditions can overlap.

A phone may be powered on, locked and encrypted.

It may be powered on, unlocked and encrypted, with data currently accessible through the active session.

Or it may be powered off and encrypted, waiting for the passcode after restart.

The distinction matters operationally.

An unlocked device may offer access that disappears when it locks or powers down.

A locked device may still preserve active connections and visible notifications.

A powered-off device may be protected more strongly but is less exposed to remote changes.

Each condition has different risks and opportunities.

The operational takeaway is: power, lock and encryption are separate layers. Identify each one accurately because preservation and examination decisions depend on the device’s exact state.

What to check or do next¶

• Record the power state, lock state, visible screen, connectivity and whether the device has restarted.

Evidential limits¶

An encrypted device stores protected data in a form that cannot be read without the correct key.

It cannot receive new messages or perform normal background activity, but when restarted it may require the main passcode before protected data becomes accessible.

Do not assume that locked means inaccessible, encrypted means unrecoverable or powered off means preserved perfectly.