Lost Device and Work Profiles

On modern Android, a secure lock unwraps file-based encryption after a reboot. Swipe, no lock, or 1234 / birthday is a weaker practical story. Use a PIN of at least six digits that is not a date, or a passphrase. Biometrics sit on top of that secret. Auto-lock in seconds. Hide OTPs and bank alerts on the lock screen — Topic 6 already taught notification access; the glass is the analog version. iOS: a strong passcode makes Data Protection meaningful; Face ID sits on top. Do not leave the device unlocked on a public charge port. For a daily driver you bank on, keep the lock boring and strong so opportunistic theft and bathroom-install spyware get expensive.

cat >> "$NOTES" << 'EOF'
lock: strong PIN/phrase/biometric — not swipe/1234
job: unwrap encryption for ME only
EOF

Find My Device (Android) and Find My (iOS) must be on before the loss, on a phone YOU own, signed into YOUR account, MFA’d from Topics 4 and 5. After a loss: lock, locate only if recovery is safe, erase if the data would hurt — from a browser or device you own. That erase is for hardware you enrolled. It is not a roommate wipe, a partner hunt, or a “CEH joke.” If the situation is abuse or stolen-identity crime, use official recovery and local safety resources — not a find-the-person op. Do not “test Find My” on a roommate. Do not share find-account passwords into this app. OEM lag is not a reason to skip the lock or find toggle.

A work profile or MDM-enrolled phone is the employer’s container: corporate mail and wipe policy without necessarily owning your entire camera roll — or a company phone that stays a company phone. Greyed toggles, required PIN, blocked unknown sources, and Integrity checks are policy, not a CTF. Circumventing MDM is out and often a policy problem. Use the device as issued. BYOD means read what IT actually manages. If you do not want employer wipe on your only photos, do not enroll that phone — that is an IT conversation, not a jailbreak assignment. Do not enroll a classmate into a test MDM. If YOUR enrolled device shows YOUR status to YOU, reading it is in scope; changing someone else’s policy is not.

Lost in a taxi: lock from find, rotate important passwords from a CLEAN device if it may have been unlocked, call a number you already have. Stolen: safety first, then lock/erase, then bank and mail revoke. A map pin in a place you cannot safely go is not a movie chase — erase if the data hurts. Do not hire a shady tracker APK. Do not dox a pin. If you find a stranger’s phone, official lost-and-found or staff — not opening it, not “checking for malware as a favor.” Returning it locked is kindness. Browsing it is unauthorized access. CEH-shaped curiosity plus a found phone is how people get expelled.

Date (UTC). Lock type in words — never the secret. Auto-lock. Notification hide. Find My Device or Find My: on, YOUR account (not the address). Work profile / MDM: yes/no/n/a, issued as issued. Ethics: no roommate wipe, no locate-a-person, no MDM bypass, no found-phone browsing. Legal: original Cyberlium teaching mapped to the CEH v13 mobile-platforms domain — not official EC-Council training, not a cert, not exam dumps. Path: $HOME/cyberlium-lab/lost-device-notes.txt, chmod 600. Honest “Find My was off; I turned it on” passes. Testing erase on a partner, posting a classmate locate screenshot, or chmod 644 on a shared PC fails. Reading the find toggle is the lab. Erase is for actual loss.

Open Settings on a phone YOU own. Copy facts, not secrets. Run the checker; extra args are refused so this cannot become a remote-wipe tool. chmod 600. Enable Find My / Find My Device if it was off. Do not erase a working phone for the screenshot.

cat >> "$NOTES" << 'EOF'
work_profile: separate work data
refuse: MDM bypass puzzles
EOF

You now treat lock, encryption, and find-on-YOUR-account as one stack, and MDM as a container you do not bypass. Other people’s wipes and found-phone browsing are out. Notes are locked. This is original Cyberlium teaching mapped to the CEH v13 mobile-platforms domain — not official EC-Council training, not a cert, not exam dumps. Next — Lab — Android/iOS Hygiene on YOUR Phone — unknown sources off, lock screen, one extra MFA; Topic 6 checklist; mobile-hygiene-lab.txt chmod 600.