When your phone screen cracks, the reflex is to get it fixed as quickly as possible. The phone goes into a technician’s hands, sometimes for hours, often with your passcode, and comes back working — and you don’t think much about what happened in between.
University researchers who have studied this gap in detail did think about it. In a controlled study, 6 out of 16 repair technicians accessed personal content on devices left for repair without the customer’s permission. Two technicians copied files — including personal photos — to external storage. In the majority of snooping cases, the targets were personal photos, browsing history, and financial records.
This doesn’t make every repair shop untrustworthy. It does make device preparation before any repair worth five to ten minutes of your time.
What Technicians Can Access — With and Without Your Passcode
The access picture depends heavily on whether your device is locked or unlocked when it goes in for repair.
With your passcode, a technician has access to everything a phone owner has access to: photos, messages, email, cloud sync previews, notes, banking apps, stored passwords, browser history, and any document stored locally on the device. Providing a passcode to enable testing is common — many repair shops require it to verify the repair worked before returning the device — but it’s worth understanding what that access unlocks.
Without your passcode, the picture is different. Most modern phones in a locked state prevent access to photos and messages. However, some data remains accessible without unlocking: the devices can be connected to a computer and, in some configurations, show basic file system information. More importantly, technicians replace or access hardware components — batteries, screens, cameras — that can be examined physically regardless of software locks.
The research finding that technicians accessed content without the passcode is notable for a different reason: some devices left for repair weren’t fully locked, or were locked in ways that didn’t prevent access to the gallery through hardware-level manipulation. The study also found that USB data transfer modes, if left enabled on the device, opened additional access pathways.
Digital Forensics Tools Are Widely Available
A detail that surprises many people: the tools to extract data from a locked or damaged phone aren’t exclusive to law enforcement. Commercial forensic tools — Cellebrite, UFED, Oxygen Forensics — are available to businesses, including phone repair shops and third-party device processors. Some of these tools can bypass standard lock screen protections on certain devices and extract data without a passcode.
This doesn’t mean every repair shop has forensic extraction capability. The hardware is expensive and the software requires licenses. But the pathway from “phone left for repair” to “data extracted without knowledge” isn’t technically impossible — it’s a function of what tools a given shop has and what its employees choose to do.
The more common risk in the research isn’t sophisticated forensic extraction. It’s a technician with an unlocked device and a USB cable. Which is why preparation before the repair matters more than assumptions about what’s technically difficult.
Samsung Maintenance Mode: How It Works
Samsung introduced Maintenance Mode as a direct response to the privacy concerns around device repair. It’s available on Galaxy devices running One UI 5 or later (most devices from 2019 onward with updated software).
When you enable Maintenance Mode, the phone creates a temporary separate user profile for the technician. Within that profile:
- Personal photos, messages, emails, contacts, and accounts are hidden
- The technician can access only stock apps and the phone’s hardware diagnostic tools
- Apps installed by the primary user are invisible
- Any changes the technician makes within Maintenance Mode — app installations, settings changes — don’t affect the main profile
To enable it: Settings → Battery and Device Care → Maintenance Mode → Turn On. The phone restarts into the restricted mode. When you retrieve the device and restart it normally, the main profile is restored unchanged.
Maintenance Mode is the cleanest solution to the data access problem for Samsung devices. It allows the technician to do genuine diagnostic and repair work while preventing access to personal content entirely.
iPhone: What You Can Do
Apple hasn’t shipped an equivalent to Samsung’s Maintenance Mode as of mid-2026. The options for iPhone are less elegant but still meaningful.
Stolen Device Protection (enabled under Settings → Face ID & Passcode → Stolen Device Protection) adds a biometric requirement before sensitive account changes can be made, and adds a one-hour security delay for certain settings modifications. It’s designed for theft scenarios, but it reduces what a technician with your passcode can do to your accounts.
Create a temporary Apple ID for repair. This is more involved but effective for extended or mail-in repairs: set up a secondary Apple ID, sign out of your primary account, sign in to the temporary one. The phone functions normally for hardware testing with no access to your primary account’s data, messages, photos in iCloud, or payment information.
Disable iCloud Photos sync before repair. If you turn off iCloud Photos syncing before handing over the phone (Settings → Photos → Sync this iPhone → Off), your photo library is no longer actively syncing to the device and the camera roll reflects only what’s locally stored. For a fresh device or one where you’ve recently offloaded photos, this significantly reduces what’s available locally.
Back up, then remove sensitive content. Before any repair, back up the device fully (iCloud or local backup via your computer), then use the Files app or Photos app to remove content you’d rather not have accessible. Restore from backup after you get the phone back.
The Full Pre-Repair Checklist
The steps that cover most risk scenarios, in order of priority:
1. Back up the device completely. To iCloud, to your computer via Finder/iTunes, or to both. This protects against data loss from the repair itself — dropped devices, accidental factory resets, parts replacement that wipes local storage. Data loss during repair is more common than data theft; backups protect against both.
2. Enable Maintenance Mode if you have a Samsung. It’s the most effective single step for Samsung devices.
3. Sign out of financial apps. Banking apps, investment accounts, crypto wallets — sign out before the repair. This limits what’s accessible even on an unlocked device.
4. Note your repair order number and the technician’s name if provided. Creates a record if something requires follow-up.
5. Provide the minimum passcode access necessary. If the shop requires a passcode to verify the repair, ask whether you can return to test the repair yourself rather than providing the code in advance. Many shops will accommodate this.
6. Note what’s on the device before you leave. Recent photos count, app arrangement, notification counts — anything you’d notice is different if you looked. Not to surveil the technician but to notice if something has changed.
After You Get the Phone Back
A few things worth checking when the device returns:
Review recently accessed files. On Android, some file managers show file access timestamps. On both platforms, Photos shows recents by date — anything accessed but not viewed by you would show up here.
Check for unfamiliar apps. Installed apps can be browsed in Settings; anything you don’t recognize warrants investigation.
Review connected accounts. Settings → [Apple ID / Google Account] → connected devices. Any new device authorizations made while your phone was at the shop would appear here.
Change your passcode. If you provided it to the repair shop, changing it afterward is good basic hygiene. A passcode is easier to change than anything the technician could have accessed with it.
The Backup Is the Key Step
The most consequential damage from a compromised repair isn’t data theft — it’s data loss. A repair that goes wrong, a restore that fails, a device that comes back factory reset — these happen at repair shops, often through error rather than malice. The backup step is simultaneously the most important preparation for both scenarios.
For personal photos specifically: if your most important photos exist only on your device and in iCloud or Google Photos, “back up before repair” means confirming that sync is complete, not just assuming it is. Photos can fail to sync for a range of reasons — connectivity issues, storage limits, app bugs — and a phone that goes into repair without a confirmed complete backup is a phone where irreplaceable photos are at risk.
daftei’s approach to this: manual uploads are always available alongside any automatic sync, giving you a confirmed, auditable record of what’s backed up before you hand the device over. Files stored in daftei are encrypted with TLS 1.3 in transit and AES-256 at rest, and access requires your account credentials — separate from the device passcode you might provide to a repair shop.
For photos that matter enough that you’d feel the loss — back up before the repair, verify the backup is complete, then hand over the phone.