What evidence may exist outside the physical device?¶
A mobile investigation should never begin with the assumption that all relevant evidence is on the handset.
What this means¶
Important material may exist with the mobile network, the device-account provider, individual app providers, cloud-storage services, linked devices, backup systems, notification services or organisations the device connected to.
A mobile-network provider may hold subscriber details, billing records, call or messaging data, connection records and cell-site information, depending on the service, provider and retention period.
A device-account provider may hold account registration details, trusted devices, backup information, synchronisation records, security events and service activity.
An app provider may hold account details, connection logs, message or content records, delivery events, payment information, reports, moderation records or login history. The exact records vary considerably and should never be assumed.
Cloud services may contain photographs, documents, contacts, backups, location history, application data or older versions of material no longer visible on the device.
Linked devices can also matter. A smartwatch, tablet, laptop, vehicle system or second phone may contain notifications, message copies, pairing records or evidence of account use.
Evidence may also exist in the systems the device interacted with. Workplace networks, Wi-Fi providers, websites, payment systems, access-control systems and other recipients may each hold a different part of the activity.
Outside evidence is especially important where the device is missing, damaged, encrypted, reset or unavailable.
The operational takeaway is: map the wider evidence environment early. Identify the network, device account, app accounts, cloud services, linked devices and external systems, then preserve or request the records that could answer the investigative question.
Evidential limits¶
These sources do not necessarily agree. Times may be recorded differently. Content may synchronise late. One system may record an attempted action while another records completion. Deletion on the handset may not remove provider or backup records.