Can a communications call involve several devices or sessions?¶

A messaging call may appear against one account but involve several devices behind the scenes.

Evidential caution: that the call was made or answered on the primary phone.

What this means¶

An account may be active on a phone, tablet, desktop application or browser session.

An incoming call may ring on several devices. One device may answer while others stop ringing.

The call may also transfer between devices or continue through a linked session after the primary device is no longer active.

This matters because device location and possession may differ from account activity.

Consider shared computers, delegated organisational accounts, remote access and account compromise.

In reports, distinguish the account-level call event from the physical device and person involved.

Where the issue is disputed, compare account, device, recipient and provider records before drawing a conclusion.

What to check or do next¶

• Preserve linked-device records, call logs, session information, application data and device-specific timestamps.
• Compare records from all likely devices. One may show the incoming alert, another the connected call and another only synchronised history.
• Where possible, identify the session or device that accepted or initiated the call.
• Preserve the source and collection method so another investigator can test the same interpretation.
• Preserve the source and collection method so another investigator can test the same interpretation.

Evidential limits¶

Do not assume that the device later seized was the one used during the call.