What is a mobile application actually doing?¶
A mobile app is local software acting as one client of a wider service. It may store data, call provider systems, synchronise accounts, receive background events and interact with device hardware.
Evidence is distributed¶
The handset can hold databases, settings, cache and notifications while the provider holds account, content and session records. Backups and linked devices add further copies. Content displayed locally may have been created elsewhere through the same account.
Permissions can allow camera, microphone, contacts, location, storage and Bluetooth access. Background processes may create records without the app being visibly open.
Ask how the service produced the artefact¶
Identify the signed-in account, local storage, provider records, permissions, background functions and linked devices. A record may represent user input, an incoming event, synchronisation or automation.
The app and its account are distinct, so an icon does not identify the service identity or human actor.
Key takeaway
Treat an app as one component of a distributed service and establish which local, provider or automated process created an artefact before attributing it to a user.
