Can a device be controlled remotely?¶

Yes. Cloud recovery, employer management, support tools, malware and stolen credentials can all change or operate a handset from elsewhere, but the mechanism and relevant-time activity need evidence.

Distinguish control from synchronisation¶

Remote tools may view screens, install software, alter settings, delete data or lock and wipe the device. Synchronisation instead copies or updates account content without a person operating the handset interface. Automated services can create further changes without either form of direct control.

Look for management profiles, remote-access apps, administrator permissions, malware, trusted devices, security alerts, login history and network connections. Preserve handset, account and provider records because the controlling device and authentication may be elsewhere.

Test the alternative explanation¶

Do not invoke remote control as a vague answer to inconvenient evidence. Establish that a capability existed, who could use it and whether records show it active during the event. Avoid opening or testing suspicious tools without specialist advice because that can alert another user or alter evidence.