Can a passcode or biometric unlock identify the user?¶

Passcode knowledge or biometric enrolment can support access and control, but neither proves responsibility for every later action on the handset.

What unlock evidence can establish¶

Knowledge of an uncommon code may show familiarity, while an enrolled fingerprint or face links a person to authorised unlock capability. A reliably recorded unlock event may show that a particular mechanism opened the device at a time.

Codes can be observed, shared, reused or guessed. Several biometrics may be enrolled, another person may know the code and the device may already be unlocked when activity occurs.

Corroborate beyond access capability¶

Combine unlock evidence with possession, accounts, communications, location and usage patterns around the event. Demonstrated access supports control but does not identify who opened an app, composed a message or created a file later.

Do not test credentials or biometrics outside lawful authority and an established process. Attempts may trigger security controls and alter evidence.