Police Can Take a Phone. Searching It Is a Different Act.

The object at the center of modern phone-search law was taken from David Riley’s pants pocket after a 2009 traffic stop in San Diego. Officers searched it without a warrant, moving through contacts, photographs and videos that prosecutors later tied to a gang-related shooting. The Supreme Court ruled in 2014 that the search-incident-to-arrest doctrine, which lets police inspect physical items carried by an arrested person, did not give them the same automatic authority over the phone’s contents.

That ruling is often compressed into a clean sentence: police need a warrant to search a phone. The real sequence is less clean. A phone can be seized before it is searched, held while investigators seek judicial approval, connected to commercial extraction hardware, copied into proprietary software and reviewed by officers long before a judge decides whether any of that material may reach a jury.

The warrant supplies legal authority. It does not supply the passcode, defeat encryption or make an extraction reliable. Vendors sell those capabilities separately.

Taking the device is the first legal act

Police may seize a phone found during a lawful arrest when they have reason to preserve it as evidence. They may also take one under a search warrant, with consent, or in an emergency where they can establish exigent circumstances, meaning an urgent threat that makes waiting for a warrant unreasonable. Border searches operate under a different and heavily litigated set of rules.

Seizure means control of the object. Search means examining information. Riley drew that line because a phone can hold years of messages, movements, photographs, browsing and records of association, rather than the limited evidence available in a wallet or cigarette pack.

Once police have the device, they commonly try to prevent remote commands or network activity from changing it. The preservation stage matters technically because a reboot, a drained battery or a change in lock state can affect what an extraction tool can reach. It also matters legally. Officers may protect evidence while applying for a warrant, but an extended delay can be challenged as an unreasonable interference with the owner’s property and privacy interests.

Riley’s phone was already in police hands when officers opened it. The constitutional violation came from treating possession of the hardware as permission to inspect the life stored inside.

A warrant describes the proposed search

To obtain a warrant, investigators submit an affidavit establishing probable cause, a practical basis for believing that evidence of a specified crime will be found in the place to be searched. A judge or magistrate then decides whether the affidavit supports the request.

The Fourth Amendment also requires particularity. A phone warrant should identify the device and describe the evidence sought, often through categories such as communications, photographs, location information or records tied to a relevant period. A warrant that authorizes a search for evidence of any crime, across every application and every year of the device’s use, starts to resemble the general warrants the Fourth Amendment was written to prevent.

Courts still allow investigators some room to inspect files while locating responsive evidence, since a misleading filename or an application container can conceal what a file contains. That practical allowance creates the opening for broad review. Once an extraction turns the phone into a searchable database, the technical ease of running another query can outrun the limits written on the warrant.

A warrant may also include authority to use a fingerprint or face to attempt an unlock, although courts disagree about when compelled biometric access raises Fifth Amendment concerns. The paper can authorize an attempt. It cannot promise that the attempt will work.

Extraction tools decide what becomes visible

Police agencies buy phone-forensics products from companies including Cellebrite, Magnet Forensics and Grayshift. Procurement records and public reporting show a market built around licenses, training, hardware and continuing access to newly developed methods. Large agencies may operate their own laboratories. Smaller departments can send devices to regional, state or federal facilities, adding a queue between seizure and review.

A logical extraction requests information through interfaces the operating system already permits. A file-system extraction reaches the phone’s directory structure and application data more deeply. A physical extraction, when the device and tool support it, attempts to copy raw storage, which may expose deleted remnants or databases unavailable through ordinary menus. These labels describe levels of access, not guarantees of completeness.

The result is usually an extraction package rather than a detective scrolling through the original phone. Software parses messages, call records, media, browser artifacts, application databases and location traces into reports. Investigators can filter by date, keyword, contact or file type. A hash, a mathematical fingerprint used to verify that data has not changed, can help document the integrity of the copied material.

Parsing is interpretation. An application may store timestamps in an unexpected format, retain thumbnails after full images disappear or record a server event that does not prove a person saw it. Deleted does not always mean recoverable, and recovered does not always mean intelligible. A polished report can conceal those distinctions unless someone examines the underlying database and the tool’s method.

This is where Riley’s physical phone becomes something else: a vendor-mediated representation of the phone, arranged for police review by software the public did not write and the defense may struggle to inspect.

The lock state can matter as much as the warrant

Modern phones encrypt stored data, turning it unreadable without the required cryptographic keys. On many devices, the conditions differ before and after the user first unlocks the phone following a restart. After that first unlock, some keys may remain available to the operating system even when the screen locks again, giving forensic tools a different technical target.

Investigators may try known passcodes, exploit a software vulnerability or use a commercial unlocking product. Success varies by model, operating-system version, security settings and the tool’s current capabilities. A method advertised for one configuration may fail after an update. Another may retrieve only part of the device.

The market depends on this unevenness: agencies keep paying because access expires as manufacturers patch flaws and release new hardware.

Police can also seek an order compelling the owner to provide access. Courts are divided over whether forcing someone to disclose or enter a passcode violates the Fifth Amendment protection against compelled self-incrimination. The dispute often turns on whether the act communicates knowledge the government does not already possess, and whether the government can show with sufficient certainty that particular files exist and belong to the person. Biometric unlocking has produced its own conflicting rulings.

None of those fights disappear because trial is months away. They happen during investigation, often while the government retains the device and explores other routes to the same information.

The phone is not the only place to look

A failed device extraction does not end the search. Investigators can pursue cloud backups, account records or stored communications from service providers through warrants and other legal demands governed partly by the Stored Communications Act. They may also obtain relevant conversations from another participant’s phone.

These routes produce different datasets. A provider may hold account metadata or synchronized content that is absent from the seized handset, while encrypted material stored only on the device may remain inaccessible. The legal showing can differ too. Authority to search one phone does not automatically authorize a search of every remote account connected to it.

The distinction is easy to lose once all the records appear in one investigative file. It remains crucial when the defense asks where each item came from and which legal demand covered it.

Before trial, retrieval and admissibility separate

Defense lawyers can move to suppress evidence obtained through an unlawful search, challenge a warrant as overbroad or unsupported, and dispute whether officers exceeded its scope. They may also seek the extraction report, audit logs, tool version and forensic image needed to test what the software did. Access to a qualified independent examiner costs money, while proprietary vendors can resist disclosing methods as trade secrets or restrict documentation to law-enforcement customers.

Courts may still admit evidence under exceptions, including the good-faith rule when officers reasonably relied on a defective warrant. They may exclude some files while leaving others intact. Authentication presents another issue: showing that data came from a device does not by itself establish who typed a message, created an account or controlled the phone at the relevant moment.

So the decisive event may occur well before trial. Police acquire a durable copy, software organizes it, investigators build leads from it, and prosecutors shape the case around those leads. A later suppression ruling can remove evidence from the courtroom without erasing everything the investigation learned along the way.

Riley’s phone established that the pocket does not cancel the warrant requirement. Commercial forensics has since moved the practical boundary downstream, into extraction logs, licensing contracts, undisclosed exploits and arguments over what the warrant’s words meant after software made the contents searchable.

This is a general map, not legal advice. The governing rules vary by jurisdiction and facts, while the tool’s reach can change with a routine operating-system update.

Questions people ask

Can police search a phone immediately after an arrest?

Usually not merely because the phone was found during the arrest. Riley v. California generally requires a warrant for digital contents, although consent, exigent circumstances and specialized contexts such as border searches can change the analysis. Police may still seize and preserve the device while seeking judicial authorization.

Can a warrant force a phone to unlock?

A warrant can authorize police to attempt access, but it cannot defeat encryption by itself. Compelling a passcode or biometric unlock raises separate constitutional questions, and courts disagree about when the Fifth Amendment applies. Technical success also depends on the device, its software version, its lock state and the extraction tool available.

Can police recover deleted messages and photos?

Sometimes. Recovery depends on whether the underlying data remains in storage, whether encryption keys are available and whether the forensic tool can parse the relevant application database. A deleted thumbnail, notification or database entry may survive without the full message, so a report’s label should not be mistaken for complete context.

What can the defense challenge before trial?

The defense can contest the seizure, the warrant’s probable cause and particularity, the extraction’s scope, compelled access and the reliability or interpretation of forensic results. Effective review may require logs, the original extraction and an independent expert, which makes vendor secrecy and unequal forensic resources part of the constitutional problem.