What is a mobile application actually doing?¶

A mobile application is software running on the device to provide a particular service or function.

What this means¶

But an app is often only the visible front end of a much larger system.

It may store some data locally, send other data to a provider, synchronise with the cloud, receive background updates and communicate with linked devices.

The investigator sees an icon.

The evidence may be spread across the handset, the app account, provider systems, backups, notifications and network records.

An app may access the camera, microphone, contacts, location, storage, Bluetooth or other device features, depending on permissions and design.

It may also continue running or communicating when the user is not actively looking at it.

That means app records can be created through background synchronisation, automated processes, incoming messages or scheduled activity.

An app can also display content that was created elsewhere.

A message, photograph or account change visible on the phone may have originated from another device using the same account.

The practical questions are:

What service does the app provide?

Which account is signed in?

What does it store locally?

What might the provider hold?

What permissions and background functions does it use?

What other devices are linked?

The operational takeaway is: treat the app as one part of a distributed service. Separate local device evidence from account, provider, cloud and background activity before attributing an action to a person.

Evidential limits¶

Do not assume that opening the app is the only way activity occurs.

Do not assume that deleting the icon removes the account or provider-held data.

And do not assume that every record proves deliberate user action.