I have found a mobile device that may be relevant. What happens next?¶

The initial photographs preserve the handset, notification, displayed time, battery state, mobile connection and exact recovery position.

Record the scene around the device as well as the screen. A cable, vehicle mount, written passcode, packaging or second device may explain ownership or use. Physical condition can also matter: damage, moisture or a loose charging connection may change the handling decision.

Do not open the notification merely because the phone is unlocked. Opening an app may mark content read, cause synchronisation or replace what was visible. What to record from an unlocked phone is different from conducting a search or examination.

Specialist advice is obtained while the handset remains powered, unlocked and on charge from a controlled power source.

There is no universal instruction to switch every phone off, leave every phone connected or remove every SIM. Restarting may place data behind encryption; leaving a device online may allow synchronisation or remote change. Whether to switch a device off, whether to use airplane mode and whether isolation can cause evidence loss depend on the device state, risks and available specialist support.

The decision and its reason are themselves part of the evidential history. Record charging, isolation, shielding, screen-lock and network changes, including what was observed before and after. A low battery creates urgency; it does not create permission to improvise.

The handset contains one physical SIM, one active eSIM and several service accounts; none is simply another name for the device.

The device, telephone number and user account are separate attribution layers. The handset has IMEI and serial identifiers. The physical SIM and eSIM have their own subscription identifiers. Applications hold account and installation identifiers that may also appear in provider records.

IMEI, IMSI and ICCID answer different questions. Recording them precisely allows network, subscription and device evidence to be compared at the relevant time without pretending any one identifier names the human user.

Network and application returns place the same handset, subscriptions and account into a relevant-time sequence around the fire.

The mobile network records the physical SIM using IMEI ending 7724 until 00:52. The eSIM is then active on the same IMEI. The messaging provider records account ACC-77104 using application installation INST-6042 on that handset model at 01:17:49. A separate navigation account requests the commercial unit's rear entrance at 01:06.

Those records are mutually useful because they observe different parts of the activity. The SIM change does not create a new handset, and the application installation does not identify a person. Together they provide a strong, time-specific line of enquiry. Provider-held app evidence, mobile-network records and mobile-account records may each extend what is locally available.

Purchase, account, vehicle and recovered-device evidence converges on Mila Shore while preserving a real question about another user.

The handset purchase and principal cloud account are in Mila's name. Her regular number used IMEI ending 7724 for four months before the fire. Vehicle records show her insured to use VRM-418, and footage places her driving it earlier that night. The agreed examination finds the navigation result, account ACC-77104, a locally cached version of the rear-gate message and photographs of the unit taken earlier that week.

A phone found in a vehicle does not prove who used it; possession is not automatic ownership, and several people can use one device. Here, however, long-term network association, account control, vehicle use, relevant local artefacts and matching provider events independently agree. That is strong circumstantial evidence pointing towards Mila, not a conclusion based on the contact name at the top of a screen.