One Click After Seizing the Phone
— and the entire case collapsed
The case looked perfect.
The phone was secured according to procedure.
The data had been extracted.
The lawyer was convinced it was a formality — a verdict in the bag.
The problem appeared later.
Someone — acting in good faith.
Often a lawyer or a technician.
Turned the phone on after it had already been seized.
No airplane mode.
No Faraday isolation.
The system did exactly what it was designed to do:
background synchronization, service updates, system writes.
Some key data was overwritten.
In court, one question was asked:
“Can we trust this evidence?”
We couldn’t.
The case went back to square one.
Months of work — lost.
Digital forensics is not magic
It is procedure, discipline, and risk awareness.
Always:
- ✈️ airplane mode
- 🛡️ Faraday bag
- 📝 documentation of every step
One click can cost:
- freedom
- money
- custody of children
That’s why I’ve been repeating this for years:
Digital evidence is most often destroyed
not by the perpetrator,
but by lack of procedural knowledge.
Full Case Description
A case from a digital forensics expert opinion
1. Case Context
The case concerned court proceedings in which a mobile phone constituted a key carrier of digital evidence.
The device contained, among other things:
- text communications (SMS, messengers),
- application data,
- system metadata critical for event reconstruction,
- time-based information (logs, timestamps).
The phone was seized at an early stage of the proceedings and handed over for further procedural actions.
At that point, all participants believed the evidence was complete and secure.
2. Procedural Error
After the physical seizure of the phone, an improper technical action occurred:
- the phone was powered on again after seizure,
- airplane mode was not enabled,
- the device was not isolated in a Faraday bag,
- there was no full documentation of this action.
This was done in good faith — most often by a technician or a lawyer who wanted to “check the device” or “make sure everything works”.
3. Technical Consequences
After the device was powered on, the operating system performed automatic background operations, including:
- synchronization with cloud services,
- system component updates,
- creation of new system logs,
- overwriting of certain memory areas.
As a result:
- part of the relevant data was irreversibly modified or overwritten,
- the continuity and integrity of the evidence were compromised,
- it became impossible to clearly distinguish data from “before” and “after” the device was powered on.
4. Procedural Consequences
During the court proceedings, a fundamental question arose:
“Can we be certain that the presented evidence reflects the state of the device at the time of the incident?”
Based on the expert analysis, it had to be concluded that:
- the integrity of the evidence was breached,
- the evidentiary material lost its full procedural value,
- some evidentiary conclusions could no longer be considered reliable.
In practice, this meant:
- reverting the proceedings to an earlier stage,
- undermining months of procedural work,
- a real weakening of one party’s position in the dispute.
5. Expert Conclusions
This case clearly demonstrates that:
Digital evidence is most often not destroyed by criminal action,
but by a lack of procedural knowledge on the part of those involved in the proceedings.
Digital forensics is not magic or “data recovery on demand”.
It is a strict procedure, where the following matter:
- the sequence of actions,
- isolation of the carrier,
- full documentation of every step,
- awareness of system-level risks.
6. Rules That Could Have Prevented the Problem
In this case, it would have been sufficient to consistently apply basic rules:
- ✈️ airplane mode immediately after seizure,
- 🛡️ storage in a Faraday bag,
- 📝 detailed documentation of every action,
- ❌ no “test” powering on of the device.
One click of the “power” button turned out to be more expensive than the most complex forensic examination.
7. Expert Summary
This case is now used as training and warning material for law firms and procedural authorities.
It clearly shows that:
- technology always operates according to system logic,
- courts assess the credibility of the procedure, not intentions,
- an expert does not “fix” procedural errors — they only reveal them.
8. Contact — Before Someone Clicks “Power”
If your case involves digital evidence:
- mobile phones,
- computers,
- messengers,
- application data,
it is worth consulting before performing any technical action.
If you have a case involving digital evidence,
write before someone clicks “power”.
📧 biuro@wichran.pl
📞 +48 515 601 621
Piotr Wichrań
Court-appointed IT forensic expert
Digital forensics and cybersecurity specialist