First Response & Preservation Technical Explainer
Could a phone synchronise deletions or edits?¶
Yes.
Cloud-linked applications can apply changes made somewhere else even while the phone itself appears untouched.
The practical point
Visible content is a current synchronised state, not proof that the same content always existed in that form.
Remote changes can reach the phone¶
Examples include:
- deleted messages;
- edited documents;
- removed photos;
- changed permissions; and
- altered account settings.
Other device/serviceContent changedEdit or deletion occurs elsewhere.
Cloud serviceNew state storedProvider now has updated version/state.
Preserved phoneSync receives changeLocal view may update without local interaction.
Preserve before refreshing¶
Record:
- account;
- application;
- visible content;
- time;
- connection indicators; and
- whether the phone is online or reconnecting.
Avoid reopening or refreshing an app simply to see whether it is current. That action may itself trigger the synchronisation.
Later absence does not prove earlier absence¶
If an item disappears during handling, record when that was first noticed.
Provider logs, account exports or device examination may still reveal:
- deletion event;
- prior version;
- cached copy;
- sync history; or
- other device state.
The practical point is: treat synchronised changes as events to reconstruct, not as proof that earlier content never existed.
