What is actually stored on a mobile device?¶
A mobile device can store far more than messages and photographs, but it rarely stores a complete record of everything connected with it.
What this means¶
Typical local material may include contacts, call history, SMS or MMS messages, photographs, videos, downloads, browser artefacts, application data, account details, device settings, Wi-Fi networks, Bluetooth pairings, notifications and location-related records.
The device may also hold authentication material. That can include session tokens, saved credentials, cryptographic keys or trusted-device information that allows an app or account to remain signed in.
Some data is visible to the user. Other data sits in application folders, system databases, caches, logs or deleted space and may require specialist extraction or interpretation.
Storage also varies by device state. An unlocked, powered device may expose data that becomes harder or impossible to access after it locks or restarts. Encryption, operating-system version, application design and security settings all affect what can be recovered.
A crucial limitation is that local storage is only one part of the picture.
An app may show a conversation while the provider retains account, connection or delivery records elsewhere. A photograph may appear on the handset because it was synchronised from the cloud. A notification may remain after the underlying message has been deleted. A browser entry may exist locally even though the web service holds separate records.
The reverse is also true. Material may exist on the device but never have been backed up or synchronised.
The operational takeaway is: think of the device as one evidence store among several. Preserve its state, identify the relevant apps and accounts, and compare local material with cloud, provider and linked-device records before drawing conclusions.
Evidential limits¶
Do not assume that the presence of data proves who created it or knew about it. Content may have been received automatically, generated by an app, restored from backup, copied from another device or placed there by another user.