What the Police Do with Digital Evidence from Phones, Laptops and Tablets

In brief:

In criminal investigations, UK police use advanced forensic software to extract data from digital devices, including encrypted and deleted content. If you have had a device seized, the data on that device is now central to whether the prosecution can prove its case.

UK police extract data using a tiered set of forensic methods, recover deleted messages and photos in many cases, and use cell site records to place a device at a location. Police digital evidence covers far more than just messages that have been sent from a device: it includes browser cache, automatic backups, cell site location data, and metadata you have never seen.

If you have been arrested, are under investigation or are facing charges, it is essential to understand how police use digital evidence and what legal defences there are.

Working with a digital forensics specialist, our criminal defence solicitors can find gaps in the police report and run defences such as accidental download, unsolicited attachments, thumbnail-only evidence, and missing creation dates.

This guide sets out what UK police actually do with digital evidence, what they can and cannot recover, and where the legal defences sit.

How do the police extract data from phones and other digital devices in the UK?

Police forensic units work with a layered set of extraction methods. The framework sits within the College of Policing Authorised Professional Practice on extraction of material from digital devices and the statutory powers in the Police, Crime, Sentencing and Courts Act 2022. The method chosen depends on the device, its condition, and how much access the user has given.

Manual, logical and physical extraction

Manual extraction is the simplest method: the device is unlocked, and an officer scrolls through it, recording what is visible. This is often used in less serious cases or when the suspect has consented and provided the passcode.

Logical extraction uses forensic software such as Cellebrite UFED or Magnet AXIOM to pull structured data from the device: contacts, messages, photo metadata, call logs, app data, and location history. Logical extraction does not normally recover overwritten or deeply hidden data.

Physical extraction copies the entire memory of the device, including the unallocated space where deleted files often sit. This is how the police recover a great deal of the material the user thought had been removed.

Cloud, JTAG and chip-off methods

If the device is locked, damaged, or heavily encrypted, the police can apply more invasive techniques.

• Cloud extraction pulls data from linked iCloud, Google, or Microsoft accounts where lawful authority allows. WhatsApp, Telegram, and other apps that back up to the cloud are exposed through this route.
• JTAG uses the device's debugging ports to read memory directly from the circuit board.
• Chip-off physically removes the memory chip and reads it on specialist equipment. It is destructive and rare, but it is used on damaged or encrypted devices.

How long extraction takes, and how long the police can keep your device

Extraction time varies. A straightforward phone can be processed in hours. A multi-device case with encrypted accounts can run for months.

There is no fixed statutory deadline for the police to return a seized device, and retention is governed by the investigating force's data extraction and retention policy. In most cases, property seized by the police can be held until a case has been resolved and the officers have no further need for the items.

If your device has been held longer than is reasonable, your solicitor can apply for its return.

Can the police unlock your phone or laptop without the password?

If you are arrested, officers may ask you to provide a passcode, pattern, or fingerprint to access a device.

You are not legally required to provide a password during a police interview, unless you are served with a Section 49 Notice under the Regulation of Investigatory Powers Act 2000 (RIPA). Failing to comply with a properly served Section 49 notice is itself a criminal offence.

If access is refused, the police will try to bypass the device using forensic tools. Success depends on:

• The device model and operating system version. Older phones and tablets are widely accessible. The newest iPhone and Android flagships often resist mainstream forensic tools until a new exploit is published.
• The security setting. A four-digit PIN can be brute-forced in many cases. A longer alphanumeric password is far harder.
• Whether biometrics are enabled. Officers can sometimes compel a fingerprint or face scan in custody.

Before responding to a Section 49 notice, it is imperative that you speak to an expert solicitor. The right decision is not always the obvious one, and the consequences of either option can be significant.

Can the police recover deleted messages, photos and files?

In many cases, yes. When you delete a file, the device usually marks the space as available for reuse rather than immediately wiping the data. Until that space is overwritten, the file can be recovered.

Deleted text messages, WhatsApp and chat apps

SMS, iMessage, WhatsApp, Signal, and Telegram messages can often be partially or fully recovered after deletion, particularly where:

• The device has been backed up to iCloud or Google Drive.
• The chat app keeps a local database that has not been compacted.
• The message was only deleted on one side of the conversation.

Recovery is rarely complete. Solicitors and digital forensics specialists frequently find that a chat presented by the prosecution as a coherent conversation is in fact a fragment. Missing messages on either side can change the meaning of what remains, and a sequence that looks like an answer to one question may actually be the answer to another that has been lost.

Deleted photos, videos and thumbnails

Photos and videos behave similarly. The headline file is deleted but the underlying data and thumbnail copies often remain. Thumbnails are the small preview images displayed in galleries. They are created automatically by software and stored separately, and can persist long after the original is gone. The date a thumbnail was created is frequently not recorded by the device, which becomes important for the defences set out below.

Why "deleted" rarely means gone

A few practical points worth knowing:

• Restoring a device to factory settings does not always wipe storage on older hardware.
• "Secure delete" tools work on some files but not on cloud copies or app backups.
• Even where a file's name, folder, and creation date are lost, the file content can persist for days or weeks until the space is reused.

What other digital evidence do the police rely on?

Beyond the device itself, the prosecution will often draw on:

Cell site data

Mobile phones connect continuously to nearby masts so that incoming calls can be received. Network operators retain logs of which mast a phone connected to and when. The police use these logs to map a device's approximate location over time. Cell site evidence is common in drugs, conspiracy, and serious assault cases. It places a phone, not a person, and the accuracy varies with mast density.

Web browsing, search history and cached files

Forensic tools recover URLs, search terms, cached images, and download records. Many files that appear inaccessible (browser cache, pop-up content, thumbnails) are saved automatically by the operating system or browser, without the user clicking anything. The police often classify these alongside intentionally saved files in their reports, which is a regular source of misunderstanding.

Cloud accounts, social media and group chats

Police can obtain content from iCloud, Google, Microsoft, and major social platforms using lawful production requests. Group chats carry particular risk: an unsolicited image sent into a chat is downloaded automatically by many apps, leaving forensic traces on the recipient's device that look identical to a file the user requested.

For an overview of how all of these categories are used in court, see our guide to the types of evidence used in criminal law.

Legal defences when digital evidence is found on your device

Police digital forensic evidence rarely speaks for itself. A defence solicitor working with an independent computer specialist can challenge interpretation, intent, knowledge, and the chain of evidence. The strongest defence routes include the following.

Pop-ups, auto-loaded webpages and accidental downloads

If illegal images are found in the browser cache, the prosecution may have to explain how they got there. A webpage can load illegal content automatically, including from a pop-up, a redirect, or a link that looked like legitimate adult material. If the forensic report cannot show what was clicked or typed to trigger the page, the defence can argue accidental exposure.

Unsolicited attachments in group chats and email

Files received as email attachments or in chat apps are often saved to the device automatically. If the forensic evidence does not show a request from the user for the file, no message asking for it, and no search that led to it, the defence can run unsolicited receipt. This route is particularly powerful where messaging apps download images by default, and the suspect was a passive recipient.

Thumbnail-only evidence and missing creation dates

Where the prosecution relies on thumbnails, a digital forensics specialist can establish how each thumbnail was created and whether it implies viewing or possession. A thumbnail can exist on a device because:

• The original file was browsed in a folder gallery, and a preview was generated automatically.
• The thumbnail was created at the moment a file appeared in a list of items not yet viewed.
• The original was deleted, but the thumbnail was not.

If the creation date is unavailable and the original is gone, the prosecution's case on intent can be significantly weakened.

Gaps and ambiguity in the police forensic report

Police digital forensic reports are not always as clear as they appear. Common issues include:

• Files described as "accessible" were, in fact, in the browser cache.
• "Deleted" files presented without context on when or how they were deleted.
• Sequences of messages presented as complete chats when parts are missing.
• Conclusions on intent or knowledge are stated without supporting forensic detail.

A defence specialist re-examining the report can expose these gaps, often forcing the prosecution to revise the charges or, in some cases, discontinue.

What to do if the police seize your phone, computer or tablet

A few practical points, in order:

• Take legal advice before responding to any request for a passcode, fingerprint, or PIN. This is especially important where a Section 49 notice has been served.
• Your rights in police custody set out the framework. Ask for a copy of the property reference and the seizure record; you are entitled to know what has been taken and the basis for it.
• Do not attempt to wipe, factory-reset, or delete data from any other device you still have access to. Doing so can amount to a separate offence (perverting the course of justice) and is usually recoverable forensically in any event.
• If you believe the data extracted goes beyond what is reasonable and necessary, raise it through your solicitor. The Information Commissioner's Office has set out concerns about over-broad mobile phone data extraction by police forces in England and Wales.

Frequently asked questions

Can the police see messages I have deleted?

In many cases, yes. Forensic tools can recover SMS, iMessage, and chat-app messages that have been deleted, provided the storage space has not been overwritten, and the device has not been securely wiped. Recovery is often partial, and the missing context can change the meaning of what remains.

Can the police get into an iPhone without the passcode?

Sometimes. Forensic tools can bypass older iPhone models and certain iOS versions. The newest devices often resist mainstream tools until a new exploit is published. The police may also serve a Section 49 RIPA notice requiring you to provide access, which carries criminal penalties if you refuse without a lawful excuse.

How long can the police keep my phone or laptop for evidence?

There is no fixed statutory limit. Devices can be retained while an investigation continues, which may be weeks or months. Your solicitor can challenge unreasonable retention and apply for the return of property under the Police (Property) Act 1897.

What happens to data extracted from my phone if I am not charged?

Data retention is governed by the investigating force's policy and by data protection law. Where the case ends without charge, your solicitor can request the return of the device and deletion of extracted data that is not relevant to any continuing investigation.

Can the police use WhatsApp messages as evidence?

Yes. WhatsApp content can be recovered from the device, from iCloud or Google Drive backups, and from the other party's handset. End-to-end encryption protects messages in transit, not on a device that has been unlocked or backed up.

Is "I did not know it was on my device" a real defence?

Potentially, in the right circumstances. Many files are saved automatically through browser cache, thumbnails, and unsolicited downloads. If the forensic report cannot show intent or knowledge, the defence is genuinely open. It must be built on the technical evidence and the specifics of the device, not on assertion alone.

Contact our criminal defence lawyers today

For a free initial consultation, urgent specialist advice, immediate representation, or to speak to us confidentially about allegations involving digital evidence, please do not hesitate to get in touch.

You can contact our dedicated criminal defence lawyers in London, Birmingham, and Manchester by telephone on:

• London Central - Head Office: 020 7624 7771
• West Hampstead Office: 020 7624 7771 
• Manchester Office: 0161 835 1638
• Birmingham Office: 0121 614 3333

Or email: solicitors@jdspicer.co.uk

Alternatively, you can fill out our quick online enquiry form, and we will get back to you as soon as possible.

24/7 legal representation for crimes involving digital evidence

Please get in touch for a free initial consultation with one of our expert criminal defence solicitors, as well as immediate representation and advice on dealing with allegations that involve digital evidence.

We are available to represent clients all over England and Wales at any time, so please contact our Emergency Number at 07836 577 556.