Preparing a phone for examination begins with a brief description of the case and a conversation with the person who will carry out the examination. You do not need to ‘tidy up’ the device yourself first or prove that the data you seek is still on it. The most useful steps are to identify specific questions and accurately describe the phone’s current condition. Agree on how it should be handled before transporting or sending it.

Establish what the examination should cover

Instead of a general instruction to ‘check the entire phone’, prepare questions relevant to the case. Is the issue a particular conversation, photos from a given day, call history, or identifying the files from which a presented copy originated? Specify the approximate period, the application name and known identifiers of the people involved. The contact name displayed on screen is a useful clue, but also provide a known number or account address where possible.

Also explain whether you have the device itself, a copy of it, a conversation export or only screenshots. This helps establish what material will actually be available. A description is sufficient at the enquiry stage. Passwords, lock codes and all your private correspondence are not needed to present the basic issue.

A phone’s condition affects data availability

Modern devices use encryption, and data availability may depend on the system’s state and whether it has previously been unlocked. Android documentation distinguishes storage available before unlocking from data protected by the user’s credentials. Apple describes file protection linked to hardware mechanisms. Possessing the phone alone therefore does not mean that all stored information can be read. [1] [2]

There is no single instruction to ‘always switch it off’ or ‘always unlock it’ that is appropriate for every model. SWGDE highlights, among other things, the importance of power loss, restarting, connectivity and changes made while handling the device. Decisions about power, network isolation or continued use require an assessment of the particular device. Until you receive guidance, limit unnecessary actions; do not try passcodes, reset or update the device, or install data recovery software. [3]

Prepare a brief description without further searching

Record what you already know. Do not change settings solely to complete the following list:

  • phone brand and model, if known;
  • whether it is switched on, switched off, locked or damaged;
  • which incident, application and period the questions concern;
  • when the missing data was noticed and what was done with the device afterwards;
  • whether updates, resets or recovery attempts were performed;
  • whether there are known backups or other devices containing this correspondence;
  • which deadline matters and in what form the findings are needed.

It is useful to separate your observations from assumptions. ‘I could not see the conversation on Monday’ describes an observation. ‘The conversation was deleted on Monday’ is a conclusion that may require verification. If you do not remember a date or action, indicate that uncertainty.

Agree on transfer and documentation

Before visiting or sending a parcel, agree on the method of transport, the accessories required and how to handle the power supply. Also describe any damage, liquid exposure or previous repair. Do not dismantle the device in preparation for examination. NIST guidelines treat preservation, data acquisition, analysis and reporting as separate stages; describing the material being handed over helps maintain continuity of information about its origin and handling. [4]

Establish who is handing over the phone, which items accompany it and what actions have already been performed. The examination's scope should correspond to the agreed questions and the authority to make the material available. It is also useful to discuss in advance how results will be delivered and the device returned.

Hypothetical example

A client wants to clarify the course of arrangements with a contractor. They have a phone, several screenshots and a backup made before the dispute. Instead of restoring the backup onto the phone, they provide a description of these three sources and the dates of relevant conversations. This allows the examination to be planned without mixing material from different periods. Only an assessment of the device and available data will show which questions can be answered and which limitations must be stated.

Sources

Primary documents; accessed: 23 October 2026.

Digital forensics—scope of examinations →