Cellphone Seizure Best Practices

A practical guide for front-line officers on handling mobile devices during seizure while protecting digital evidence.

1. Initial Observation & Documentation

• Do not manipulate the phone – don’t unlock, power off, or search it.
• Identify device type – note if it’s an iPhone or Android, and model if visible.
• Photograph the phone, screen, time/date, notifications, and any visible IDs/serial numbers.
• Record seizure details – where, when, who seized it, and in what condition.

2. Isolation & Signal Blocking

• Prevent remote access – place device in a Faraday bag immediately.
• Avoid powering off – powering down moves the device to BFU (Before First Unlock).
• Battery management – keep powered with charger or battery pack if possible.

3. AFU vs BFU States Explained

BFU (Before First Unlock): Device restarted or off and not unlocked. Data is encrypted.

AFU (After First Unlock): Device unlocked since boot. Data is accessible for forensic extraction.

Goal: keep devices in AFU state if legally permitted.

4. iOS 18 – 72-Hour Reboot Rule

• After 72 hours of inactivity, iPhones auto-reboot to BFU state.
• This re-encrypts data and makes extraction very difficult.
• Action: If lawful, keep device powered and charging until transfer.

5. SIM Cards & Memory Cards

• Leave SIM and SD cards in the phone unless instructed by specialists.
• If removed, photograph and bag separately with evidence labeling.

6. Legal Considerations

• Ensure legal authority – seizure must be based on warrant, consent, or exigent circumstances.
• Do not search in the field – accessing data requires lawful authority.
• Maintain chain of custody – log every officer who handled the phone.

7. Transfer to Forensics

• Notify digital forensic unit as soon as possible.
• Expedite transfer to prevent power loss or reboot issues.

8. Quick Reference Checklist