Mobile evidence guidance
How should a phone be preserved before forensic examination?
Stop unnecessary interaction, document its condition and seek case-specific advice promptly. Do not reset, update, reinstall applications, browse chats or repeatedly attempt passcodes. Whether to isolate or power down depends on the device state and circumstances.
Potential evidence sources
Where relevant records may exist.
- Contemporaneous photographs and notes
- Power, lock and network state
- Known credentials recorded securely
- Chargers, SIMs and associated computers
- Backup and account information
- Chain-of-custody record
Decision factors
What materially changes the prospects.
- 01Unlocked or locked state
- 02Risk of remote access or wiping
- 03Battery condition
- 04Known passcode and failed-attempt risk
- 05Legal authority and urgency
Evidential limitations
What must not be overstated.
Generic advice cannot replace assessment of the actual device
Powering off may lose an accessible state
Leaving online may expose evidence to remote change
Sources and interpretation
Each entry identifies its limited supporting proposition and documentation-check date. General methodology is not a current device-support list. These checks are not laboratory validation; availability and method suitability require assessment for the exact source and configuration.
- NIST mobile device forensics guidance
Methodological background (2014), not a current device-support list.
General methodology · Documentation checked
Confidential case review
