Mobile Devices & Apps¶

127 investigator questions.

Use the list below or search the complete library.

• A mobile device may be relevant to my investigation — where do I start?
• What counts as a mobile device?
• What is the difference between a mobile phone, smartphone and tablet?
• What is actually stored on a mobile device?
• What evidence may exist outside the physical device?
• What is the difference between the device, the phone number and the user account?
• What is the difference between a handset, SIM, eSIM and mobile subscription?
• What identifiers might I find on a mobile device?
• What is an IMEI and what can it tell me?
• What is an IMSI and what can it tell me?
• What is an ICCID and what can it tell me?
• I have found a mobile device — what should I record immediately?
• Should I switch the device off?
• Should I leave an unlocked phone unlocked?
• What should I do if the phone is locked?
• What should I do if the device is displaying notifications?
• Should I put the device into airplane mode?
• Should I remove the SIM card?
• Could isolating a device cause evidence to be lost?
• Could leaving a device connected cause evidence to change?
• What should I do if the battery is running low?
• What should I preserve from the lock screen?
• What should I record about the device’s physical condition?
• What should I do if the device appears damaged or wet?
• What should I do if I find several linked devices together?
• Does finding a phone with somebody prove it belongs to them?
• Does the registered subscriber identify the person using the phone?
• Can several people use the same mobile device?
• Can one person use several mobile devices?
• Can a device be controlled remotely?
• Could the phone have been lost, stolen or borrowed?
• What evidence helps identify who actually used the device?
• Can a passcode or biometric unlock identify the user?
• Does a saved account prove who used the device?
• Does a contact name prove who owns a telephone number?
• What is a mobile operating system?
• What is the practical difference between Android and iPhone evidence?
• Why does the device model and operating-system version matter?
• What is device encryption?
• What happens to evidence when a device restarts?
• What is the difference between a device being locked, encrypted and powered off?
• What does rooting or jailbreaking mean?
• Could rooting or jailbreaking affect the reliability of the device?
• What is a factory reset and what does it remove?
• Can data remain after a factory reset?
• What is a mobile application actually doing?
• What is the difference between an app and an app account?
• Does deleting an app delete the account?
• Does deleting an app delete its data?
• Can the same app account be used on several devices?
• Can several accounts be used in the same app?
• What evidence might an app store locally?
• What evidence might the app provider hold?
• What is cached app data?
• What are app permissions and why do they matter?
• What can an app learn about the device?
• Can an app run or communicate in the background?
• Could an app create records without the user opening it?
• Could deleting a message from an app leave evidence elsewhere?
• Could app content differ between the device and the provider?
• What is a mobile cloud account?
• What is the difference between the device account and an individual app account?
• What is a mobile-device backup?
• What might be stored in an iCloud or Google backup?
• Does a cloud backup contain everything from the device?
• Could evidence exist in the cloud but not on the phone?
• Could evidence exist on the phone but not in the cloud?
• What does synchronisation mean?
• Can deleting something on one device delete it from other devices?
• What are linked or trusted devices?
• What records might the mobile-account provider hold?
• What is the difference between an SMS, MMS and app message?
• Does a message on a phone prove who sent it?
• Does a sent-message record prove the recipient received it?
• Does a delivered status prove the message was read?
• Does a read receipt prove a person read the message?
• Can messages be sent automatically?
• Can messages be edited or deleted after sending?
• What does end-to-end encryption mean for an investigator?
• Can an encrypted messaging provider still hold useful records?
• Does a contact entry identify the real person behind it?
• What does a mobile call record actually prove?
• Does a call log prove the call connected?
• Does the phone number identify the caller?
• Can a mobile number be spoofed?
• What is number porting?
• What is SIM swapping?
• Can a telephone number move between devices and networks?
• What records might a mobile-network provider hold?
• What is cell-site data?
• Does cell-site data identify the phone’s exact location?
• What types of location evidence may exist on a mobile device?
• What is the difference between GPS, Wi-Fi and cell-site location?
• Does a location record prove the user was there?
• Could location data be inaccurate?
• Could an app record location in the background?
• What is location history?
• Can location settings be switched off?
• Could location data be altered or spoofed?
• What evidence should corroborate a mobile location record?
• What can a photograph on a mobile device prove?
• What metadata might a mobile photograph contain?
• Does photograph metadata prove where the photograph was taken?
• Does a photograph on a phone prove the user took it?
• Could a photograph have arrived through an app or cloud service?
• Can edited photographs retain original evidence?
• What is a screenshot and what can it prove?
• Does a screenshot prove that the displayed event happened?
• What evidence might exist for deleted photographs or videos?
• Does mobile browser history prove who visited a website?
• Does a search record prove what the user intended?
• Could a browser or app create history automatically?
• What is private or incognito browsing?
• Does private browsing leave no evidence?
• What evidence might a mobile keyboard retain?
• What are notifications and what can they reveal?
• What are application usage records?
• Can screen-time or usage records show which apps were used?
• What should I ask the mobile-network provider for?
• What should I ask an app provider for?
• What should I ask the device-account provider for?
• Which mobile evidence is most likely to disappear quickly?
• How do I distinguish device evidence from provider evidence?
• How do I build a mobile-device attribution investigation?
• How do I link a device, account, number and person?
• When should I seek specialist support for a mobile-device enquiry?
• When is a mobile-device line of enquiry worth pursuing?