The Digital Witness: Phone Evidence in Plain English

A modern phone is the closest thing an investigation has to a witness that was there the whole time. It knows where its owner went, who they talked to, when they were awake, and which apps they opened. Getting that witness to talk, though, is harder than most people think.

This is meant for anyone in the justice system who works with phone evidence but doesn't extract it: investigators, attorneys, victims, judges, and jurors. It covers what a phone records, why getting into one is a race against the clock, and why the honest answer to "can you get the data?" is usually "it depends."

1. Phones are not just phones anymore

People still talk about getting the "texts" off a phone. That undersells it. A smartphone quietly records an enormous amount of daily life, often without the owner knowing:

• Where it has been. Phones log frequent places, nearby Wi-Fi networks, and movement, sometimes even when location services appear to be turned off.
• How it was used. The system keeps its own records of when the screen turned on, when the phone was unlocked, and which app was open at a given moment.
• What the body was doing. Health apps record steps, heart rate, and whether the person was standing or moving.
• What it was connected to. Logs show when Bluetooth headphones or a car connected and disconnected.

That is why phone evidence so often confirms, or contradicts, what people say happened.

2. The phone is built to keep us out

Phone makers design their devices to protect the owner's privacy, and they are very good at it. Everything personal on a modern phone, including messages, photos, and app data, is encrypted. Think of it as a vault that only the owner's passcode can open.

Forensic tool companies and phone makers are in a constant back-and-forth. The tool companies find a weakness that lets examiners in. The phone maker releases an update that closes it. A phone that could be accessed last month might not be accessible after a software update, and access may return months later once the tools catch up.

iPhone: one design, very strict

Every modern iPhone has a separate security chip, which Apple calls the Secure Enclave. It holds the keys that unlock the owner's data, and those keys never leave it. You can't simply pull the memory chip out and read it, because without that security chip the data is unreadable.

The upside for examiners is consistency. iPhones of the same model and software version behave the same way, so if a tool works on one, it will usually work on others like it.

Android: many makers, many answers

Android is not one phone. Samsung, Google, Motorola, and dozens of other companies build their own versions on different hardware. A method that works on one model may fail on another running the same version of Android, or even on the same model with a newer security update. High-end phones generally have strong security chips. Budget phones often do not, which can make them easier to access.

That is why a blanket statement like "Androids can't be unlocked" is never accurate. The right answer is specific: this model, with this security update, is or isn't supported by the tools available today.

3. Why the answer is usually "it depends"

When someone asks whether a phone's data can be recovered, an examiner has to weigh several things at once:

• The hardware. Some older iPhones, up through the iPhone X, have a permanent flaw in their chips that Apple cannot patch. Newer models don't.
• The software version. A single update the night before a phone is seized can be the difference between access and no access.
• The passcode. A 4-digit PIN has 10,000 possible combinations and can be guessed relatively quickly. A 6-digit PIN has a million and can take far longer. A long password with letters and symbols may not be guessable in any practical amount of time.
• The state the phone was in when it was seized. This one matters most, and it is covered next.

4. "Locked" is not one thing: BFU and AFU

A phone can be locked in two very different ways, and the difference can decide a case.

• Before First Unlock (BFU). The phone has been turned on or restarted, but no one has entered the passcode yet. The vault is sealed. Examiners can usually recover very little.
• After First Unlock (AFU). The owner has entered the passcode at least once since the phone was last turned on. Even if the screen is now dark and locked, the vault is partly open so the phone can keep receiving messages and running apps. In this state, examiners can often recover most of the phone's data.

The practical lesson is simple. Don't turn a seized phone off "to save the battery." Turning it off and back on puts it into BFU, and that can lock away most of the evidence for good.

The 72-hour clock

Apple and Google now restart phones automatically if they haven't been unlocked for about three days. On iPhones, this inactivity reboot arrived with iOS 18. Google added a similar auto-restart for Android phones in 2025. The restart puts the phone back into BFU.

The clock starts at the owner's last unlock, not when the phone is seized. A phone collected on a Friday night and left in an evidence locker over the weekend may already have restarted by Monday morning. Phones need to be preserved quickly, not whenever the lab gets to them.

Other timers worth knowing

• Face ID and fingerprints expire. An iPhone will require the passcode instead of a face or fingerprint after a restart, or if it hasn't been unlocked for more than 48 hours, among other conditions. Holding the side and volume buttons to bring up the emergency SOS screen also turns off Face ID until the passcode is entered.
• The charging port shuts off. If an iPhone has been locked for more than an hour, it stops talking to most USB accessories, including forensic equipment, and will only charge.
• The law around unlocking is unsettled. Courts generally treat forcing someone to reveal a passcode differently from requiring a fingerprint or face, and the rules vary by jurisdiction. That is a question for the prosecutor, not the examiner.

5. Not all "extractions" are equal

When a report says a phone was "extracted," the first question to ask is: what kind of extraction?

• Logical extraction. The tool asks the phone for a copy of what it is willing to share, much like a backup. You get contacts, texts, call logs, photos, and some app data. You usually don't get deleted items, private messaging apps like Signal, or the phone's own activity logs. It is like looking at a house through the windows.
• Full file system extraction. The tool gets deeper access and copies essentially everything stored on the phone, including private app databases, system activity logs, and sometimes deleted records. It is like walking through the front door and opening every drawer. This is the standard for serious investigations.

You may also hear the term "physical extraction," meaning a raw copy of the memory chip. On modern phones that copy is unreadable without the encryption keys, so it has largely been replaced by the full file system extraction.

What about the cloud?

For years, investigators could serve a search warrant on Apple or Google for a user's cloud backup. That is changing. If an iPhone user turns on Apple's Advanced Data Protection, most of their iCloud data is encrypted with keys that only their own devices hold, and Apple can't unlock it. In those cases, the phone itself becomes the only way in.

6. What the evidence can actually show

Once the data is out, the examiner's job is to explain what it means. Some of the most useful evidence isn't a message at all.

• Messages. Texts, iMessages, and apps like WhatsApp and Signal. With a full extraction, even encrypted messaging apps can often be read, and iMessage can show when a message was delivered and read.
• Location. Frequent places, Wi-Fi networks the phone saw, and, when it's turned on, a detailed map of the person's movement.
• Phone activity. The phone logs when it was unlocked and which app was on the screen. If someone says they were asleep at 2:00 a.m. but their phone was unlocked at 2:03 and WhatsApp was opened at 2:04, that record stands even if the messages themselves were deleted.
• Health data. A sudden run of steps or a spike in heart rate at a key moment can support, or undercut, someone's account.
• Bluetooth connections. When headphones or a car connected can show what someone was doing, and when.

Deleted doesn't always mean recoverable

Television has convinced many jurors that "nothing is ever truly deleted." On modern phones, that is not true. Phone storage cleans up deleted files on its own, often within minutes or hours, to keep the phone fast. Recovery is possible only in the window before that cleanup happens. The full content of an old deleted message is often gone, although traces of it, like a notification record or the fact that it existed, may survive longer.

7. What this means for the people who use phone evidence

A phone can't lie, but it speaks a complicated language, and that language changes with every software update. The people who collect, examine, and argue over phone evidence owe it to everyone involved to understand it well enough to get it right.

The views in this article are my own and do not necessarily represent the Richland County Sheriff's Department. Nothing here is legal advice.

Sources

• Apple, The Secure Enclave (Apple Platform Security)
• Apple, About Face ID advanced technology
• Apple, How to turn on Advanced Data Protection for iCloud
• TechCrunch, New Apple security feature reboots iPhones after 3 days, researchers confirm, 2024
• 9to5Google, Android auto-restart security feature, 2025