Often, yes. Police digital forensics units use commercial tools (the best known are made by Cellebrite, Magnet Forensics and Grayshift) that can extract data from many phones without the passcode. How much they can get depends on the device, its software version, and how it was locked.

What tends to be weak

  • Short numeric PINs and swipe patterns. A 4-digit PIN has 10,000 combinations and a 6-digit PIN a million; forensic tools can try these automatically on many devices, and some can bypass the delay that normally slows repeated attempts.
  • Devices that are out of date. Older Android phones that no longer receive security updates, and older iPhones, have known vulnerabilities that extraction tools exploit.
  • Rooted or jailbroken devices, unless carefully configured.
  • Devices seized while switched on and recently unlocked, which may be in a state where more data is accessible than after a restart.
  • Cloud backups. Even if the handset resists, data may be obtained from Apple, Google or app providers with the right legal process.

What tends to be strong

  • A long alphanumeric passcode (letters, numbers and symbols, no obvious words or repetition) combined with full-disk encryption. Modern iPhones and most recent Android phones are encrypted by default, but encryption is only as strong as the passcode protecting the key.
  • Fully updated software. Both iOS and Android now restart or re-lock after periods of inactivity precisely to defeat extraction tools.
  • Hardware-backed security (Apple's Secure Enclave, Android's Titan and similar chips), which limits brute-force attempts.
  • Face and fingerprint unlock are convenient, and are hard to forge, but they can be used against you if you are compelled or tricked into looking at the device. Both platforms let you quickly disable biometrics (for example, by pressing the power button repeatedly), after which the passcode is required.

Pulling memory chips off the board ("chip-off") still happens with older devices, but on an encrypted phone it produces encrypted data and little else.

The legal side

  • The police do not need your permission to attempt to access a device they have lawfully seized. Section 20 of PACE lets them require information held on a computer to be produced in a readable form, and they can examine the device itself.
  • You generally cannot be forced to hand over a passcode unless a notice is served under section 49 of the Regulation of Investigatory Powers Act 2000, which needs judicial authorisation and carries a prison sentence for non-compliance. See our Section 49 guide.
  • Deliberately wiping or destroying a device after you know it is wanted as evidence can be perverting the course of justice, which is a serious offence. Securing your data in advance is lawful; destroying evidence is not.

Why this matters for everyone

Good device security protects you from thieves and fraudsters as much as from anyone else. A long passcode, up-to-date software, and knowing how to disable biometrics quickly are sensible habits regardless of whether you ever meet the police.

This is general information for England and Wales, not legal advice. If you have been arrested or charged, speak to a solicitor: advice at the police station is free for everyone.