Can they just take them offline? Or...at do they at some point need to be online for the evidence gathering?

I wonder how can they prove that she did it? Or it's your phone, you know the password and let's try to convict you? If it was programmed to be erased before the phone was taken /crime committed she is not guilty I guess.