Question 1

Can a court really order someone to hand over their passcode?

Accepted Answer

In civil proceedings, courts order disclosure of access information where necessary to make imaging and disclosure effective, and meet refusal with adverse inference, costs and enforcement: Example 3's machinery. The criminal/regulatory sphere has section 49 RIPA's compelled-disclosure regime with penal teeth, operated by authorities under safeguards. Neither guarantees the code appears: what they guarantee is that refusal acquires a price, which is frequently enough.

Question 2

How long should we keep a device we cannot currently open?

Accepted Answer

In preserved custody for the matter's life, reviewed at milestones: Example 2's eight-month frontier movement is not rare, and storage is cheap against the option it keeps open. The review discipline matters more than the duration: a dated re-check at each case stage, and a deliberate decision: not a default: if preservation is ever abandoned.

Question 3

Is it worth paying for exotic unlocking services?

Accepted Answer

Frame it as the capability check frames it: what does this device, in this state, actually admit: at what cost, risk and lawfulness: against what the ensemble already delivers? Sometimes specialist access is decisive and proportionate; often the same spend on cloud process and counterpart collection answers the case faster. Beware unconditional promises and provenance-free tools: the access must be lawful, documented and explicable in a CPR 35 report, or it is a liability wearing a receipt.

Question 4

The custodian offers to unlock it himself and show us the messages. Acceptable?

Accepted Answer

As a route to scoping conversations, perhaps; as evidence, no: the self-guided tour is uncontrolled (what was scrolled, what was deleted mid-demonstration, what the reading did to disappearing messages) and unrepeatable. The counter-offer is the protections package: examiner extraction, targeted scope, personal content filtered: which meets the legitimate concern behind the offer while producing evidence that survives challenge. Guide 117 details the password-free variants.

Question 5

What if the device wipes itself during exam in at i on?

Accepted Answer

Planned exam in at i on makes this a managed risk, not a gamble: wipe-on-failure settings assessed before attempts, budgets that stop short of trigger counts, iso l at i on preventing remote commands, and: where risk remains: the ensemble collected first so the worst case is bounded. A wipe under uncontrolled amateur attempts is a catastrophe; under laboratory protocol it is a foreseen contingency with the evidence already banked else where.

Question 6

Does a factory-reset device end the inquiry?

Accepted Answer

It ends the handset inquiry and starts two others: the ensemble reconstruction (guide 61's Example 3: cloud, backups, mirrors, counterparts routinely rebuild the estate) and the conduct inquiry (the reset's timing, from act i v at i on and account records, read against the duty chronology). Modern resets on encrypted devices are genuinely effective against recovery: which is exactly why the reset itself, dated, so often becomes the exhibit. cflab. u k · e-disc ove r y. u k ©2026 Computer Forensics Lab Ltd ·cflab.uk ·e-discovery.uk ·info@cflab.uk ·+44 (0)20 7164 6915 Page 15 of 17

Locked Mobile Devices