When is a mobile-device line of enquiry worth pursuing?¶

A mobile-device line of enquiry is worth pursuing when it has a realistic prospect of answering a material investigative question.

What this means¶

The starting point is not whether a phone exists.

It is whether the device, account, number, app or provider records could help prove or disprove something important.

That may include identity, attribution, communication, movement, knowledge, association, timing, intent or access.

The enquiry is stronger where there is a clear link between the device and the relevant person, event or account.

It is also stronger where records are likely to exist and can be obtained proportionately.

Consider what evidence may sit on the handset, with the network provider, in cloud backups, within app providers and on linked devices.

Also consider urgency.

Some records are volatile.

Provider data may have limited retention.

An unlocked device may become locked or lose power.

Remote deletion or synchronisation may alter what remains.

But not every device needs a full examination.

A broad extraction without a defined question can create delay, cost and large volumes of irrelevant material.

The line of enquiry may be weak where attribution is speculative, the relevant period is unclear, records are unlikely to exist or the expected evidence would add little to the case.

Before escalating, define:

What do I need to establish?

Which source is most likely to answer it?

What is the relevant time period?

What would the result change?

The operational takeaway is: pursue the mobile-device enquiry when it is targeted, proportionate and capable of changing the investigative picture. Start with the question, identify the best evidence source and avoid examining the device merely because it is available.

Evidential limits¶

What are the realistic alternatives and limitations?