Could another household or workplace user control the device?¶

Yes. A device found with one person may be controlled, configured or used by other household or workplace users.

Avoid this assumption: Possession, location or a visible account identifies the sole user. Shared devices, family accounts, administrators, remote workers, support staff and service accounts may all affect the evidence.

Record where the device was found and who had physical possession or access.

Ask who normally uses it, who knows the passcode, who has administrator rights and whether accounts are shared.

Preserve visible usernames, profiles, logged-in sessions, account-switching options and remote-access indicators.

Record whether the device belongs to an employer, school, household member, service provider or another organisation.

Do not log into other profiles or switch users merely to test access.

Consider whether another user can alter or delete material remotely through cloud services, management tools or linked devices.

In workplaces, preserve information about domain administration, shared drives, delegated mailboxes, virtual desktops and support access.

In households, consider shared tablets, family accounts, parental controls, common passwords and automatic synchronisation.

Do not assume that an administrator created the user’s files or that the named account holder performed every action.

Where control is disputed or several users may have equal access, record the alternative explanations rather than selecting one prematurely.

Seek specialist support where access rights, remote control or shared infrastructure make the original state uncertain.

Operational takeaway¶

Treat household and workplace devices as potentially shared systems, preserve user, administrator and remote-access context, and keep technical control separate from personal attribution.