Skip to main content
Mobile devices and apps

I have found a mobile device that may be relevant

Record the device and its current state before deciding whether to interact with it. The handset, SIM, telephone number, accounts, apps and person using them are connected propositions, not one identity.

Investigate now

Start with what needs doing now

Use this route to protect access and volatile evidence while making a deliberate decision about power, lock state, connectivity and handling.

Start the investigationWork through a mobile device

Move from the device's observed state to proportionate preservation, service records, extraction questions and careful attribution.

Reference MDA-000Protect accessShould I leave an unlocked phone unlocked?

Balance continued access against interaction, remote change, power loss and the evidence created by handling.

Reference MDA-013SpeedWhich mobile evidence may disappear quickly?

Identify volatile device, application, account and provider records while they may still be available.

Reference MDA-121
Learn

Understand the evidence and the offender method

Use this route to understand what a mobile device stores and how a separate offender method creates evidence across a handset, SIMs and services.

Foundation explanationWhat is actually stored on a mobile device?

Separate locally stored data, application material, account records and synchronised cloud content.

Reference MDA-003Separate offender exampleDodgy Dave gives one phone three SIMs and calls it three businesses

See a counterfeit-goods operation create distinct device, SIM, number, account and communication records.

Reference MDA-127
Common questions

Go directly to the issue you need to resolve

Separate the identifiersDevice, phone number or user account?

Understand which object each record identifies before joining them.

Reference MDA-005IsolationCould isolating the device cause evidence loss?

Consider synchronisation, remote access, network state and service behaviour.

Reference MDA-018AttributionWho actually used the device?

Test possession and account records against usage, communications and context.

Reference MDA-031Deleted materialCould a deleted app message remain elsewhere?

Look across the device, linked devices, cloud services and provider records.

Reference MDA-058
Browse every Mobile devices and apps guidance page The complete reference library remains available when you need a narrower question.