england-and-wales (although I imagine the rest of the UK is similar in these respects):
The police will prefer direct access to the device to help maintain chain of custody and reduce risk of the defence asserting the evidence was edited or otherwise interfered with.
Police may consider using statutory powers (eg PACE or CJPA (see sections 2.1.1
and 2.1.2)) to seize a device with a view to examining its contents, in particular
if they find a device in the possession of a suspect that they believe may contain
evidence relevant to the investigation of a criminal offence.
These statutory powers may be used to obtain evidence but they do not
determine appropriate lines of enquiry. This is a decision to be made under
Part II of the CPIA and the code of practice issued under s23(1) of that Act.
In the case of complainants or witnesses, investigators may consider it more
appropriate to request that the owner of a phone consents63 to handing over
their device to the police in order for it to be examined for evidence. As with
statutory powers, this must be justified as a reasonable line of enquiry to obtain
63 This application of the word ‘consent’ is intended to have the plain English meaning of agreement and should not be confused with the lawful basis of Consent for processing personal data as defined in DPA 2018.
Level 1 mobile device examination provides a “logical” extraction. A “logical” extraction provides the live data that is readily available on device, probably all of the data you could see if you were able to turn on the device and browse through it. A logical extraction will extract the live data that is supported by the extraction software. This could vary by handset, operating system and types of applications. It may not extract all of the data present and will not usually extract deleted material.
Level 2 mobile device examination can be either a “logical” extraction using selected tools in a laboratory environment to report that data or a “physical” extraction, which recovers a bit for bit copy of the data held on the memory chip of the device. “Physical” downloads can extract deleted data, although again capabilities vary depending on the nature of the device, operating system, types of applications and whether they are supported by the extraction software.
Level 3 mobile device examinations are usually expert and bespoke methods to tackle complex issues or damaged devices. Examples include specialist evaluation and interpretation of digital data or Level 1, 2, or 3 data extraction.
It would be prudent to retain a complainant’s phone until there has been an opportunity to provide the accused with an opportunity to comment on the allegation, either through an interview or through liaison with defence representatives. This precaution itself will be fact sensitive, in that there may be cases where the delay to the return of a phone to a complainant would be disproportionate, but that consideration must be judged cautiously, with the benefit of the doubt resolved in favour of retaining the phone until an informed decision as to the level of necessary phone examination can be made.