An organization or person outside the United States can get a forensic examination from a US lab in one of two ways. The first is remote collection: the device stays where it is, and the examiner acquires the data over an encrypted connection with the custodian’s help. The second is mail-in: the device is packed, sealed, documented and shipped to the lab by tracked courier. Either way, the examination itself happens in the lab, and the evidence record has to survive two legal systems, a carrier and a customs border.
Remote collection is usually faster and avoids shipping risk, which is why our remote forensic extraction service is the first option we discuss with clients abroad. Mail-in is the better route when a full physical acquisition is needed, the device is damaged, or the connection cannot carry the data.
This is general information, not legal advice. Privacy, employment, evidence and export rules differ by country, so confirm the plan with counsel in each country involved before anything is collected or shipped.
Key takeaways
- Remote collection keeps the device in the custodian’s hands and avoids carriers and customs. Mail-in suits damaged devices, full physical images and slow connections.
- The client must confirm local law and get documented consent or authority before any collection. A US lab cannot settle that question for another country.
- Phones and laptops ship as “lithium ion batteries contained in equipment” (UN 3481). IATA’s 2026 guidance strongly recommends a charge of 30% or less for these devices, and damaged batteries are forbidden on aircraft.
- Since August 29, 2025, low-value shipments into the US no longer get duty-free de minimis treatment, so even a single phone needs accurate customs paperwork.
- Passcodes and encryption keys travel separately from the device, never in the box.
- Chain of custody should follow the ISO/IEC 27037 ideas of auditability, repeatability, reproducibility and justifiability, with seal numbers, photos and hash values at every handoff.
Remote collection or mail-in: which route fits
Remote collection works well for targeted data, such as one user’s mail store, chat history or a date range of files, and it can start the day authority is confirmed. Mail-in takes longer but gives the lab physical custody.
| Factor | Remote collection | Mail-in |
|---|---|---|
| Device location | Stays with the custodian | Shipped to the lab and returned after the work |
| Best for | Targeted data, multiple custodians, devices people still need | Full physical images, damaged or locked devices, very large drives |
| Speed to start | Same day authority is confirmed, subject to the connection | Courier transit plus customs clearance |
| Custodian effort | Follows guided steps on a video call | Packs, seals and documents the device |
| Main risks | Live system keeps changing; connection limits | Transit damage, customs delays, battery rules |
Remote collection is a live acquisition, so the system keeps running while data is copied. A good examiner records that fact and its effects in the report rather than hiding it. Our remote forensic collection guide explains the methods in more detail.
Authority, consent and local law come first
No collection should start until someone with the right to authorize it has done so in writing. For a company-owned, managed device, that is usually the organization, acting within its own policies and local employment law. For a personal device, it is the owner, through informed written consent that states what will be collected and what will be left out.
Outside the US, data protection and employment rules can limit what an employer may collect from staff, and sending a device or its data to another country can itself be a regulated transfer of personal data. Some countries also control the export of certain technology. These are questions for local counsel, and the client must answer them before collection. We do not collect from devices we are not authorized to access, and we do not collect covertly from personal devices on an employer’s instruction.
Put the scope in writing before anything moves: devices, accounts, date range and excluded categories. A narrow scope protects privacy and makes the evidence easier to defend.
Passcodes, encryption and power state
Most modern phones and laptops are encrypted by default. Without the passcode or recovery key, what a lab can extract may be limited, and the scope of any extraction depends on the model, operating system and security settings. Plan for credentials before the device leaves the custodian.
- Send credentials separately. Passcodes, PINs and recovery keys go to the examiner through a separate secure channel agreed in advance, never on a note in the box.
- Find the laptop recovery key. Microsoft says a BitLocker recovery key may be saved to the user’s Microsoft account, stored in an organization’s work or school account, printed, or saved to a USB drive. Locate it before shipping.
- Isolate the device from networks. Airplane mode, with Wi-Fi and Bluetooth off, reduces the risk of a remote wipe or new data overwriting old data during transit.
- Do not reset, update or “clean up.” Do not factory reset, remove accounts, install updates or delete apps. Each action changes the evidence.
- Record the state. Note whether the device was on or off when the custodian handed it over, its battery level, and any visible damage.
If a phone is locked and the passcode is unknown, mail-in may be the only route.
Packing and shipping devices with lithium batteries
Phones, tablets and laptops contain lithium ion batteries, which are regulated dangerous goods in air transport. IATA’s Lithium Battery Guidance Document, revised for the 2026 regulations and based on the 67th edition of the IATA Dangerous Goods Regulations, sets the rules airlines and express carriers apply. As of October 2026, the key points for evidence shipments are these:
- Classification. A device with its battery installed ships as “UN 3481, Lithium ion batteries contained in equipment,” usually under Packing Instruction 967, Section II for consumer devices.
- State of charge. For batteries contained in equipment, a reduced charge is not mandatory, but IATA strongly recommends a state of charge of 30% or less (or an indicated capacity of no more than 25%). Spare batteries packed alongside equipment (Packing Instruction 966) must be at 30% or less from January 1, 2026, with some size thresholds.
- Accidental activation. The equipment must be packed so it cannot switch on during transport.
- Damaged batteries. Batteries that are damaged or defective in a way that could cause dangerous heat, fire or short circuit are forbidden for air transport, including those in recalled devices. A swollen or crushed phone needs a different plan, so tell the lab before shipping.
- Marking. Many packages need a lithium battery mark and an air waybill statement. IATA exempts small consignments (two packages or fewer, each with no more than two batteries installed in equipment), but carriers set their own acceptance rules on top of the regulations.
Carriers also restrict dangerous goods by origin and destination (FedEx, for example, lists country and city limits on its lithium battery pages), and the carrier has the final say.
Packing checklist for an evidence shipment
- Photograph the device on all sides, including serial number or IMEI labels, before packing.
- Confirm airplane mode, battery level near or below 30%, and no visible battery damage.
- Place each device in its own sealed tamper-evident evidence bag. Write the seal number on the custody form.
- Wrap each bag in cushioning so the device cannot move or switch on, and keep chargers and loose batteries out unless the lab asks for them.
- Use a strong, rigid outer box. Do not reuse boxes with old dangerous goods labels.
- Put a copy of the custody form inside the box, and keep the original and photos with the sender.
- Ship by tracked courier with signature on delivery, and send the tracking number to the lab the same day.
Customs paperwork basics
Evidence is still goods to a customs officer. The package needs a commercial or pro forma invoice that describes the contents accurately, gives a realistic declared value and country of manufacture, and states the purpose, such as “used mobile phone sent for forensic examination, to be returned to owner.” Vague labels like “documents” or “gift” cause delays.
Since 12:01 a.m. Eastern time on August 29, 2025, a US executive order has suspended duty-free de minimis treatment for low-value shipments from all countries, regardless of value or method of entry, except shipments covered by a narrow statutory carve-out. The practical result is that even one used phone may need a customs entry and could face duties. These rules have changed more than once since 2025, so check the current position with the carrier or a customs broker before shipping.
Plan the return leg at the same time. The device crosses at least two borders, and the destination country on the way back has its own import rules. Customs authorities in either country can open a package. If that happens, the custody record should show it: a broken seal with a customs inspection notice is an explained event, while a broken seal with no explanation is a gap.
Documenting chain of custody across borders
ISO/IEC 27037:2012 gives international guidelines for the identification, collection, acquisition and preservation of digital evidence. Its requirements for evidence handling are organized around four ideas: auditability, repeatability, reproducibility and justifiability. In plain terms, another examiner in another country should be able to see what was done, repeat it and reach the same result, and understand why each step was taken.
For a cross-border case, that means one continuous record that starts with the custodian and ends with the report. Each entry should show who handled the item, when, where, what they did, and the seal or bag number at that moment. Our article on forensic imaging and chain of custody covers the lab side of this process.
- Custodian handover: date, time, time zone, names, device description, identifiers and photos.
- Packing: seal numbers, box photos, invoice copy and tracking number.
- Transit: carrier scan history, saved as a PDF on arrival, plus any customs inspection notices.
- Lab intake: seal condition photographed before opening, device condition, and identifiers matched against the form.
- Acquisition: tool names and versions, hash values of the acquired image, and any deviations from plan.
- Return: reseal, new seal number, outbound tracking and the custodian’s signed receipt.
Record every time with its time zone.
What happens in the lab and what the report looks like
Devices and data are examined in our Arizona lab under Arizona law. On arrival, the device is photographed, checked against the custody form and acquired behind write protection where the device type allows. Analysis runs on a verified copy, and results are checked with a second tool before they go into a report.
A report built for use in court or arbitration, in the US or abroad, should be readable by a judge and checkable by the other side’s expert. Expect it to include:
- The instructions received and the written scope, including deliberate exclusions.
- A device inventory with identifiers and condition on arrival.
- Methods, tools and tool versions used, and any limits on what could be extracted.
- Hash values at acquisition and verification, so the evidence can be checked later.
- Findings stated separately from interpretation, with exhibits.
- The full chain of custody from handover to return.
How Honeybadger Solutions handles international forensic cases
For clients outside the US, we work by remote collection or mail-in only, and we do not perform on-site forensic work abroad. Through our remote forensic extraction service, our examiner guides the custodian over a secure session, hashes the data at the source and on arrival, and logs every step. Where remote work does not fit, we explain how to pack and ship the device and track it through intake. In some matters, and subject to availability, we can send a preconfigured collection kit and guide the custodian through it on a video call.
Every engagement starts with the authority and scope in writing, and a written quote is given before any work starts. The deliverable is a report built to be court-ready, with methods, tool versions, hash values and chain of custody documented. If you have devices or custodians outside the US, request a forensic examination online with the device types, locations and your deadline, or book a confidential consultation to talk through the options. For a time-critical matter, use the urgent intake form.
Frequently asked questions
Can a phone be shipped to a US lab while it is switched on?
IATA’s guidance does not require devices to be switched off, but it does require packing that prevents accidental activation, and it strongly recommends a charge of 30% or less. A powered-on phone will usually drain during transit anyway. Talk to the examiner before shipping, because the right answer depends on the device and whether the passcode is known.
Do we need to send the passcode?
In most cases, yes, if you want a full examination of a modern encrypted phone or laptop. Send it separately through the secure channel the lab gives you, never inside the package. Without it, what can be extracted may be limited, and the report will say so.
Who decides whether the collection is legal in our country?
The client and its local counsel. A US lab can explain what it needs and how it documents authority, but it cannot give advice on another country’s privacy, employment or export laws. Get that confirmation in writing before any collection or shipment.
What if customs opens the package?
Keep the inspection notice and any carrier records, and send copies to the lab. The examiner documents the condition of the seals at intake and records the inspection in the chain of custody. An explained opening is very different from an unexplained one.
Sources: IATA Lithium Battery Guidance Document (revised for 2026), IATA Lithium Batteries program page, FedEx shipping guide: lithium ion batteries contained in equipment (PI 967 Section II), Executive Order: Suspending Duty-Free De Minimis Treatment for All Countries (2025), ISO/IEC 27037:2012 Guidelines for identification, collection, acquisition and preservation of digital evidence, Microsoft Support: Find your BitLocker recovery key