What is the difference between a device being locked, encrypted and powered off?¶

Power describes whether the system is running, lock describes current user access, and encryption describes how stored data is cryptographically protected. The states overlap but are not synonyms.

Combine the three states accurately¶

A powered-on locked phone can receive data, run apps and show notifications while requiring unlock for normal access. A powered-on unlocked phone remains encrypted at rest but has active keys and sessions. A powered-off encrypted phone performs no background activity and commonly requires the main passcode after boot.

Each combination changes the risk¶

Unlocked access may disappear on lock or shutdown. A locked handset may still change remotely. Power-off reduces network change but can strengthen protection and remove volatile data. None is perfectly “preserved”.

Record power, screen, lock, connectivity and whether restart occurred. Avoid statements that locked means inaccessible, encrypted means unrecoverable or off means unchanged; specialists need the exact combination.