What is a mobile operating system?¶

A mobile operating system is the core software that controls how a phone or tablet works.

What this means¶

It manages the screen, storage, applications, security, accounts, network connections, sensors and user permissions.

On most devices, the operating system will be Android or iOS.

The operating system matters because it shapes what evidence may exist, where it is stored and how it can be accessed.

It controls whether applications can run in the background, how notifications are recorded, how data is encrypted and how accounts synchronise.

It also affects what happens when the device locks, restarts, updates or is reset.

Different operating-system versions may handle the same feature differently.

An artefact available on one version may be absent, stored elsewhere or protected more strongly on another.

The operating system also separates applications from each other.

Permissions, sandboxing and security settings influence what each application can access.

That information may help specialists assess extraction options, interpret artefacts and explain why some evidence is available and other evidence is not.

The operating-system version, security patch level, manufacturer changes and user settings can all matter.

And do not treat the operating system as the user.

A system process may create records, notifications or network activity automatically.

The operational takeaway is: the mobile operating system is the control layer behind the device. Record what it is and which version is running because it affects preservation, access, interpretation and what evidence may exist.

What to check or do next¶

• Investigators should record the operating system and version where possible.

Evidential limits¶

That means one app may not be able to read another app’s data, even though both appear on the same device.

Do not assume that two devices of the same make behave identically.