Locked or Damaged Phone? Here's What Can Still Be Recovered

A Damaged Device Can Still Hold Critical Evidence

A cracked screen, a dead battery, a passcode nobody remembers, or a phone that's been sitting in evidence storage for two years. Attorneys often assume that once a device is locked or damaged, it's a dead end, and they move on without asking whether it's worth a second look. That assumption costs cases. Locked and damaged devices are recoverable far more often than people expect, and the method used to try matters as much as the attempt itself.

Not All Extractions Are the Same

When people say "we pulled the data off the phone," that phrase covers a range of methods with very different results. There are four general levels:

• Logical extraction pulls what's visible and accessible on the device, similar to what you'd see using the phone normally. It misses deleted data almost entirely.
• Advanced logical extraction goes deeper into app data and some system files but still relies on the device being unlocked and functioning normally.
• Full file system extraction captures the device's underlying file structure, including deleted items that haven't been overwritten yet and system artifacts most tools never touch.
• Physical (chip-off / JTAG) extraction pulls data directly from the memory chip itself, bypassing the phone's operating system entirely. This is the method used when a device won't power on, is severely damaged, or is locked with no other way in.

If the extraction in your case file only says "data was extracted" without specifying which method, that's the first question your expert should be asking.

What Chip-Off and JTAG Actually Involve

Chip-off forensics means physically removing the memory chip from the device's circuit board and reading it directly with specialized hardware. JTAG uses test points built into the board to access the chip without removing it. Both methods work on devices that are water-damaged, physically destroyed, or locked with an unknown passcode, because neither one depends on the phone's software cooperating.

This isn't a guaranteed recovery in every case. Severely burned or crushed chips can be unreadable. But a huge number of devices that look unrecoverable to the untrained eye, cracked screens, non-powering phones, water exposure, are still very workable with the right lab equipment and the right hands.

Why This Matters for the Defense

In our experience, the devices most likely to get written off as a lost cause are often the ones that matter most: a complainant's phone that "wouldn't turn on" when law enforcement looked at it, a co-defendant's damaged device that never made it into the state's analysis, or a client's own phone that was locked and never independently examined. If the state didn't pursue advanced extraction, that's not proof there's nothing there. It may just mean nobody tried the right method.

We've recovered deleted messages, location history, and call logs from devices that were previously reported as inaccessible by less specialized labs. The difference usually comes down to equipment and whether the examiner treated a locked screen as the end of the process or the start of it.

How Evidence Storage Time Affects Recovery

A device that's been sitting in an evidence room for months or years is not automatically a lost cause, but time and storage conditions matter. Battery degradation can eventually make a device harder to power on for standard extraction, which is part of why chip-off and JTAG methods exist as a fallback. Before assuming a long-stored device is unworkable, it's worth having a lab assess the actual physical condition rather than relying on how long it's been sitting untouched.

What to Ask Before You Assume a Device Is a Dead End

• What extraction method was actually used, logical, advanced logical, full file system, or physical?
• Was the device examined by someone with chip-off or JTAG capability, or only standard extraction tools?
• If the device is damaged, has it been assessed by a lab equipped to handle physical extraction, or only visually written off?
• Is there a report documenting what was attempted and what specifically failed, or just a conclusion that "no data was recoverable"?

"A device marked as inaccessible in a police report is a starting point for your own investigation, not a final answer."

Locked Devices Without Physical Damage

A working phone with an unknown passcode presents a different challenge, and success there depends heavily on the device model, operating system version, and available tools at the time. Some devices can be accessed through legitimate forensic unlocking methods; others cannot be bypassed without the passcode at all. An honest expert will tell you upfront which category your device falls into rather than promising results they can't deliver. Be wary of anyone who guarantees access before they've even looked at the make and model.

Chain of Custody Still Comes First

Advanced extraction only helps your case if the results can be used. That means documenting exactly how the device was handled, when it was received, what condition it was in, and every step taken during the extraction. A recovered timeline is worthless if the defense can't establish that the device wasn't altered along the way. This is where working with an experienced forensic lab matters as much as the technical capability itself.

How Black Dog Forensics Helps

We handle advanced mobile device extraction, including chip-off and JTAG recovery, for defense attorneys working with damaged, locked, or previously "unrecoverable" devices. Before we tell you what we found, we tell you exactly what we tried and how. If a device in your case was written off too early, it's worth a second opinion before you accept that conclusion for your client.