How Do UK Police Extract Data From Your Phone? (And What They Can Recover)

If your device has been seized, the short answer to how do police extract data from phones in the UK is: through a set of forensic techniques — manual review, logical extraction, file system extraction and physical extraction — plus cloud downloads from your Google, Apple or Microsoft account. Between them, these methods can pull messages, call logs, photos, location history and, in a lot of cases, data you thought you'd deleted.

If your phone has already been seized, or you think it's about to be, that answer probably raises more questions than it settles. Police phone forensics UK cases move fast, and what an officer can actually see depends on the tool used, the phone's security, and the legal basis for the search. Below is a plain-English breakdown of each method, what typically survives deletion, and where your rights sit — including whether you have to hand over your PIN.

The 4 Types of Phone Extraction

There are several police phone extraction methods in regular use, and forensic examiners generally work up through four levels of depth, choosing whichever is proportionate to the offence being investigated. A shoplifting case might only need a manual look-through; a serious fraud enquiry could justify a full physical extraction.

Manual extraction

This is the simplest tier — no specialist kit involved. An officer or analyst goes through an unlocked handset by hand, scrolling through messages, call logs, photos and open apps much as you would yourself. It's quick, but it only shows what's currently visible on screen, so it tends to be reserved for lower-level offences.

Logical extraction

Here, forensic software copies specific files and folders straight off the phone without altering its file structure. That typically means call history, texts, contacts, images and browsing history — a snapshot of live, accessible data. Once it's copied, investigators can go back and re-examine it as many times as they need, without touching the original device again.

File system extraction

Sitting between logical and physical extraction, this method pulls the phone's entire file system rather than just selected files. It gives access to the databases that sit behind your apps — the SQLite files WhatsApp, Signal or your banking app use to store data internally — which often still contain fragments of messages or records the app itself no longer shows you. It's become one of the more commonly used tiers for modern smartphones, since it recovers far more than a logical extraction without needing to break the phone's encryption entirely.

Physical extraction

The deepest non-destructive method. This creates a bit-for-bit copy of the phone's entire memory, including hidden partitions, deleted fragments and system files. In theory it can bypass certain security features, though this has become considerably harder on recent iPhones and Android devices with hardware-backed encryption — some physical extractions simply fail against the newest handsets.

Cloud extraction

Your phone is rarely the only copy of your data. With a warrant, police can go directly to Google, Apple, Microsoft or another provider and request whatever's backed up to your account — synced photos, message backups, location history, saved documents. If your phone automatically backs up to the cloud (most do, by default), this route can hand investigators data that's no longer on the handset at all.

The Tools Police Use

Most forces don't build their own forensic software — they buy commercial kiosks designed for exactly this job. Cellebrite UK police use is the most widely reported, and its UFED units sit in custody suites and forensic labs across the country, used mainly (though not exclusively) on Android devices. Graykey is the other major name, generally deployed against iPhones. Both work by connecting to the phone, running exploits or bypass techniques against its operating system, and extracting data at whichever level (logical, file system or physical) the case calls for.

In practice, a police phone download using either kiosk can take anywhere from a few minutes for a basic logical pull to several hours for a full physical extraction.

Beyond the brand names, there isn't much publicly available detail on exactly how these tools work — and for good reason, since publishing that would help people defeat them. What matters for you is simpler: these are professional-grade forensic tools capable of recovering considerably more than a quick manual scroll would suggest.

Can Police Recover Deleted Messages?

Often, yes. It's one of the most common questions we're asked, usually phrased as can police read deleted messages at all once they're gone from view — and the honest answer is that deleting something on your phone doesn't usually erase it straight away. It just tells the phone that space is free to be written over. Until that happens, the original data can still be sitting there, which is exactly what file system and physical extraction are built to find.

Whether it's actually recoverable in your case tends to come down to three things:

• Overwriting. The more the phone's been used since you deleted something, the more likely that space has already been reused for new data — at which point it's genuinely gone.
• Encryption. Storage on most modern phones is encrypted by default. That doesn't stop extraction outright, but it can make pulling coherent deleted fragments back out harder, even once the device itself is unlocked.
• App type. Not all apps behave the same way. Some, like Signal, are designed to actively overwrite deleted data rather than just mark it as free — closing off the gap far quicker than apps that leave it lying around.

None of that adds up to a guarantee either way. But if you're assuming something's unrecoverable simply because you deleted it, that assumption is doing more work than it should.

Do You Have to Give Police Your PIN?

This is the question people ask most, and the answer has real teeth. Under section 49 of the Regulation of Investigatory Powers Act 2000 (RIPA), police can serve you with a written notice requiring you to disclose your PIN, password or encryption key. Refusing to comply is a criminal offence in its own right, separate from whatever you're being investigated for, and can carry a prison sentence of up to two years (up to five years in cases involving national security or child indecency offences).

That said, a s.49 notice has to be properly authorised and served — it isn't something an officer can simply demand on the spot during an arrest. And this is precisely the moment to get legal advice before you do anything. Whether the notice itself is valid, whether you have a genuine defence to non-compliance (such as having genuinely forgotten the password), and how disclosure might affect the wider case are all questions a solicitor should be answering before you act, not after.

What Police Can and Cannot Look At

A phone extraction doesn't automatically hand investigators a licence to trawl through everything on your device forever. Searches are meant to be conducted within the scope of what's relevant to the offence under investigation, and material protected by legal professional privilege — correspondence with your solicitor, for example — should be filtered out and kept separate from the material used against you.

In practice, this line isn't always respected as tightly as it should be, and irrelevant material sometimes ends up reviewed anyway. This is one of the areas a defence solicitor will scrutinise closely, since evidence gathered outside the proper scope of a warrant can potentially be challenged.

How Long Does Phone Extraction Take?

There's no fixed timescale. A straightforward manual review might be done within a day; a full physical extraction with forensic backlogs can drag on for weeks or months. Many forces are dealing with a substantial queue of devices awaiting examination, and your phone may simply sit in storage before anyone gets to it. Under current retention rules, police can hold onto a seized phone for as long as it's considered relevant to an ongoing investigation — which, in practice, can mean an open-ended wait.

How Extracted Data Is Used in Investigations

Once data has been pulled off a device, it gets reviewed against the specific allegations being investigated — messages that might establish contact between parties, location data that could place someone at a scene, deleted files that suggest an attempt to conceal something. It can be used to build a case for charge, but it can just as easily undermine one: extracted data has a habit of cutting both ways, and a message or timestamp that clears someone is just as recoverable as one that doesn't. That's exactly why early legal input matters — a solicitor reviewing the same material can identify what helps your position before it's overlooked or buried in a much larger disclosure bundle.

FAQs

Can police get into a locked phone?

Often, yes. Forensic tools like Cellebrite and Graykey are specifically designed to bypass or work around lock screens, though success varies by phone model, operating system version and how up to date its security patches are. Some of the newest handsets have proven genuinely resistant.

Can police read deleted WhatsApp messages?

It depends on the extraction method and how much time has passed. WhatsApp messages are end-to-end encrypted in transit, but fragments can sometimes be recovered from the phone's local database through file system or physical extraction, particularly if the phone hasn't been used much since deletion.

Do I have to give police my phone password?

If served with a valid section 49 RIPA notice, yes — refusing is a separate criminal offence. Speak to a solicitor before responding to any such notice.

What is a s.49 RIPA notice?

A formal, legally authorised notice under the Regulation of Investigatory Powers Act 2000 that compels a person to disclose a password, PIN or encryption key to investigators.

How long does phone extraction take?

Anywhere from a few hours to several months, depending on the extraction method used, the phone's security, and the examining force's backlog.

Can police access my iCloud or Google account?

Yes, with a warrant. They can request backed-up photos, messages, location history and other synced data directly from Apple, Google, Microsoft or other providers, even without physical access to your phone.

Talk to a Solicitor Before You Say — or Hand Over — Anything

If your phone has been seized, or you've been told it will be, the window to get proper advice is now, not after an interview or a s.49 notice arrives. Holborn Adams specialises in pre-charge engagement, working with investigators before charges are brought to challenge weak evidence early. Contact our criminal defence team for a confidential conversation about your case.