// first 10 minutes

lost or stolen device — quick-start

lost or stolen device — first 10 minutes. remote-wipe decision point. print this, check boxes, then run the primary tools.

checklist

decide before acting: if you need forensic evidence (e.g., theft for insurance claim, unauthorized access investigation), do not remote-wipe yet.
if immediate privacy protection is the priority, trigger remote wipe from Apple Find My, Google Find My Device, or MDM — and record the trigger timestamp.
log the last known location ping from Find My, Google Maps Timeline, or carrier location service with exact UTC timestamp.
change passwords for all accounts that were signed in on the device — start with email and banking.
revoke trusted device status in Apple ID, Google account, and any banking apps that treat the device as an authenticator.
pull the MDM enrollment record for the device — includes last-check-in timestamp and installed app list.
check for any suspicious sign-in attempts on accounts after the device was lost — geographic anomalies relative to your own location.
file a police report with the device serial number, IMEI, and last location — required for insurance and sometimes for carrier unlock blocks.
contact carrier to flag the IMEI as lost or stolen — prevents resale and international unlocking.
begin the primary tool path below — device recovery artifact analyzer.