What should I ask the device-account provider for?¶

Ask the device-account provider for records that explain the wider account and device environment.

What this means¶

For an Apple or Google account, possible records may include registration details, recovery information, login history, trusted devices, security alerts, backup activity, synchronisation, device location services, account changes and app-download history.

The right request depends on the investigative question.

Some data may sit only on the handset, within an app provider or in a separate synchronised service.

Where records may be volatile, consider preservation through lawful local process.

Also remember that the account holder is not automatically the device user.

A family, workplace or shared handset may use an account belonging to somebody else.

The operational takeaway is: ask the device-account provider focused questions about account security, linked devices, backups, synchronisation and remote actions. Then connect those records to the physical device and relevant user.

What to check or do next¶

• If you need to link a handset to an account, ask about device registration, trusted-device history and identifiers.
• If the issue is backup or restoration, ask about backup dates, source devices and restore activity.
• If compromise is suspected, ask about password resets, recovery attempts, new devices, unusual logins and security notifications.
• If location or remote control matters, ask what location, lock or erase events were recorded and from which account session.
• Use the correct account identifiers and time period.

Evidential limits¶

Do not assume the provider holds every item of device content.