What evidence might a mobile keyboard retain?¶

A mobile keyboard may retain information created while the user types.

What this means¶

Possible artefacts include learned words, autocomplete suggestions, custom dictionary entries, clipboard content, recently used emojis and language settings.

Some keyboards also synchronise learned data through a cloud account.

This can provide useful leads.

An unusual word, phrase, email address or username may appear because it was typed repeatedly.

Clipboard data may preserve copied text, links or account details.

But keyboard evidence has significant limits.

The keyboard may learn from several applications.

It may import contacts or account data.

Suggestions can also come from language models, dictionaries or cloud services rather than direct user typing.

Shared devices create further attribution problems.

The keyboard type, settings and synchronisation behaviour matter.

Third-party keyboards may store different data from the built-in keyboard.

What to check or do next¶

• Investigators should not treat a keyboard suggestion as proof of a specific message or intention.
• Use it to identify possible search terms, accounts, names or phrases that can be corroborated elsewhere.

Evidential limits¶

A learned word does not prove when it was typed, where it was used or which person entered it.

The operational takeaway is: keyboard artefacts may reveal words, copied material and typing patterns, but they rarely prove a specific act on their own. Treat them as leads and corroborate them with app, account and message evidence.