What evidence helps identify who actually used the device?¶
The strongest attribution combines relevant-time possession and access with consistent behaviour, accounts, location and independent real-world evidence.
Build several independent links¶
Consider who possessed, charged and maintained the device; knew its passcode; or had enrolled biometrics. Recurring accounts, contacts, communications, photographs and payment details can show personal use. Wi-Fi, Bluetooth, vehicles, wearables and location patterns may connect it to a person's routine.
Messages addressing the user, calendars and notes add context, while CCTV, witnesses, transactions, work and travel records can independently place a person with the handset during the event.
Make the conclusion time-specific¶
The usual user may not be the user for one action. Accounts can be shared, biometrics multiple, locations indirect and messages automated or remote. Identify the limitation of each source and whether several records merely derive from the same underlying event.
Where evidence converges across independent sources, attribution strengthens. Where another user remains plausible, preserve that alternative and the next enquiry needed to test it.
Key takeaway
Attribute device use through converging evidence of control, access, behaviour and context at the relevant time, not through any single account, location or possession fact.
