Mobile Forensics · Forensics Foundations · Lesson 3 of 5

Seizing a Phone Safely

Make the right first moves with a found phone before its data slips away.

The first few minutes

An investigator with a warrant finds a phone on a table. It's unlocked, switched on, connected to cellular and Wi-Fi, and at 34% battery. What happens next decides how much evidence survives.

Document the screen first. NIST advises photographing the screen while it's viewable, capturing the time shown, signal and service status, battery level and any icons or notifications. Examiners also note the phone's clock against a trusted reference clock, since a phone's time can be set wrong. A photo records the phone's state before anything changes.

Isolate it from networks. NIST and SWGDE (the Scientific Working Group on Digital Evidence, which writes best practices for examiners) give three reasons:

• Remote wipe. The owner, or anyone with the account password, can send an erase command through Apple's Find My or Google's Find Hub. Both need the phone to be online. Apple says an erase sent to an offline device starts the next time it connects.
• New data. Incoming messages, syncs and app updates can overwrite older data.
• Scope. Data that arrives after the seizure may fall outside what the warrant covers.

There are two main ways to isolate a phone. A Faraday bag is a pouch lined with metal mesh that blocks radio signals. It doesn't touch the phone's settings, but it must be sealed properly, and NIST notes that tests found some bags still let messages through. Airplane mode turns off the radios from the phone itself. It's only possible on a phone that's unlocked or allows it from the lock screen, and it means tapping the screen, which should be documented. Wi-Fi and Bluetooth can be switched back on while airplane mode is on, so each radio needs checking.

On the simulated phone, decide what to do with the found phone. Try each action, including turning it off, and read the feedback on each one.

Power, reboots and passcodes

In Mobile Fundamentals you saw that a phone that's been unlocked since its last restart is in AFU (After First Unlock). In iOS Internals you saw why. In AFU, the keys for most app data stay in memory, even while the screen is locked. A restart or shutdown throws those keys away.

So the usual advice is to keep a seized phone powered on. SWGDE recommends connecting it to a steady power supply whenever practical. That creates a catch. A phone in a Faraday bag can drain fast, because it keeps searching hard for a signal. A charger cable running out of the bag can act as an antenna, so examiners use a battery pack sealed inside the shield or a shielded charging setup.

Time is also against the examiner. Security researchers found that iOS 18.1 and later restart an iPhone after about three days without being unlocked, and Google added a similar automatic restart for Android phones in 2025 (through Google Play services, after three days locked). The exact timing can change between versions, but the lesson is the same: a locked phone sitting in a drawer may quietly fall back to BFU. NIST also recommends processing an unlocked encrypted phone quickly, ideally at the scene, before it locks or runs out of battery.

What about the passcode? It's not something an examiner guesses. Each wrong try can make things worse:

• An iPhone adds a growing delay after repeated wrong entries, from a minute up to several hours.
• After 10 wrong tries in a row, the iPhone locks itself, and getting back in generally means restoring or erasing it.
• If the owner turned on the Erase Data setting, those 10 wrong tries erase all content and settings.

Android phones also add delays after failed attempts. Getting into a locked phone is a job for a trained lab working under proper authority, never trial and error at the scene.