Android Data Recovery

Hello all,

If an criminal is capured by the police and the criminal has an Android phone on him. the Android phone is password protected with an 4 digit pin, can the police then open the phone with an special program/device to see his files/phone calls for example, or is this illigal to do (privacy or something)? If this is possible how is this done.

And if the criminals have such program/device stolen or something, is it then possible to protect all/most files on the device, disable some options or something?

I am talking about a modern (2014 or later) Android phone WITH root.

Thanks

ps: I know most criminals will just wipe the phone and sell it, but if you wrote your passwords (or something) in a app and they steal it you're doomed.