A mobile device may be relevant to my investigation — where do I start?¶

A mobile device has appeared in your investigation.

What this means¶

It may be a phone, tablet, app account, mobile number, SIM, cloud account or a set of records supplied by a provider.

The first mistake is to treat all of that as one thing.

First, identify what you actually have. Is it a physical device, a telephone number, a SIM, an app account, a screenshot, a provider record or somebody else’s summary?

Second, define what it might contribute. Are you trying to identify a user, establish communication, place a device in an area, recover content, show association or understand a sequence of events?

Third, consider preservation. A live device may receive new data, synchronise, lock, lose power, be wiped remotely or change when handled. Provider-held data may also be retained only for a limited or variable period. Record the condition, time, screen state, connections and immediate risks before taking action.

Fourth, separate control from identity. The registered subscriber, device owner, person carrying the phone, account holder and actual user may all be different people.

Fifth, recognise when specialist support is needed. Unlocked devices, encryption, damaged handsets, live applications, remote-wipe risks and volatile data can all create consequences if handled badly.

Mobile evidence may sit across the handset, SIM or eSIM, mobile network, app accounts, cloud backups, linked devices, provider records, notifications and synchronisation services. Build the enquiry around those separate sources rather than assuming the handset contains the whole story.

The operational takeaway is: identify what you have, define the question, preserve what may change, separate the device from the user, and seek specialist help before taking an action that could alter or lose evidence.

What to check or do next¶

• Start with five decisions.

Evidential limits¶

Finding a phone does not automatically identify its user. Finding an account does not prove who operated it. Finding a message, location record or photograph does not prove who created it, knew about it or intended the activity. And the most useful evidence may not be stored on the physical device at all.