Skip to content
AI-000 Accounts & Identity

I’m interested in an online account. What can it tell me, and what should I do next?

Use the account as a starting point, not as automatic proof of who carried out the activity.

Script

You’re interested in an online account.

What might it give you, and where should you start?

An account can connect several useful types of information.

There may be registration details, such as a name, email address or telephone number.

There may be recovery details, payment information, linked devices, login records, IP addresses, security alerts and records of changes made to the account.

The provider may also hold the activity you’re actually interested in: messages, uploads, purchases, searches, transactions or other actions.

Taken together, these records may help you establish when the account was created, how it was accessed, what it was used for and which people or devices may be connected to it.

But start with an important distinction.

An account is not a person.

The registered holder, the person who created it, the person who controlled it and the person carrying out a particular action may all be different.

The account might be shared, operated for an organisation, accessed through a linked service or compromised by someone else.

Your first job is therefore to preserve the account accurately.

Record the exact username, profile address, account number or other identifier. Preserve relevant content and context. Note when and how it was obtained.

Then identify the provider and consider an early preservation request. Some records are retained for limited periods and may change or disappear.

Next, build the evidential chain.

Ask what links the account to a device, a network, a payment method, another account and ultimately a person.

The account may provide strong evidence.

What it gives you depends on the records available, their reliability and the corroboration around them.

Treat it as a route into the investigation, not the final answer.

Key takeaway

An online account can lead to valuable identity, access and activity evidence, but the account itself does not prove who performed a particular action.

Source notes

Keep moving

Where this question leads

These links explain why the next page may matter, rather than presenting an undifferentiated list.