What Should I Do If NCIS Seized My Phone?

NCIS seized my phone. What happens next? Your phone goes to a digital forensics lab. They attempt a full extraction and you may not see it again for months. I’m Michael Waddington, civilian military defense lawyer and co-founder of Gonzalez & Waddington. A seized phone is usually the moment a sailor or Marine realizes the investigation is serious. Here’s the timeline and here’s what you should be doing while you wait.

Step one, the seizure itself. NCIS takes the phone under a search authorization, a consent form you signed, or as evidence incident to apprehension. You should have been given a property receipt. If you weren’t, ask for one and write down the date, time, and agent’s name. That paperwork matters later. Step two, the extraction. The phone goes to an NCIS digital forensics examiner or a regional lab. They use tools like Cellebrite or GrayKey to pull a full image.

Messages, deleted messages, photos, location history, app data, search history. If the phone is locked with a strong passcode and no biometrics, this can take weeks or fail entirely. If you unlocked it for them, it takes an afternoon. Step three, the review. The examiner produces a report, often thousands of pages. Agents search it using keywords tied to the allegation. What they find goes into the investigative file that lands on your commanding officer’s desk.

Anything unrelated they find, other misconduct, other people, can and will be pursued separately. Step four, the decision. Your CO reads the file and decides, no action, NJP, administrative separation, or preferral of charges. The phone evidence is often the centerpiece. How long? Realistically, two to six months before the extraction is complete and reviewed. Sometimes longer. Your phone stays in evidence until the case is resolved, which can mean well over a year.

Plan on not getting it back. Now, what you should be doing. First, do not log into that phone remotely or ask anyone to. Don’t remote wipe it. Don’t change passwords in a way that looks like destruction. That’s Article 131b obstruction. Second, get a new phone and a new number if you need one. That’s fine. Third, preserve your own copy of anything helpful. If you have iCloud or Google backups, don’t delete them because your lawyer may need messages that help you.

Fourth, write down privately for your lawyer only what’s on that phone that could look bad and what’s on it that helps. Fifth, hire a military defense lawyer now because a lawyer can demand the extraction report, hire our own forensic examiner, and start the suppression fight while NCIS is still working. One more thing, the phone often isn’t the end. If they seized your phone, they’ll likely be looking at your laptop, your cloud accounts, and the other person’s phone.

Assume the whole digital picture is coming. At Gonzalez & Waddington, we regularly get phone evidence suppressed or use the same extraction to prove the accuser’s story doesn’t match the timestamps. The phone cuts both ways, but only if you have a lawyer reading it. So, NCIS seized your phone. What happens next? A forensic extraction, a long wait, and a command decision built on what they find. Don’t touch it. Don’t destroy anything, and call us.

I’m Michael Waddington with Gonzalez & Waddington. We defend sailors and Marines worldwide.