What evidence might an app store locally?¶

An app may store a wide range of evidence on the device.

What this means¶

That can include messages, contacts, media, drafts, search terms, account details, settings, notifications, cached content, location data and usage history.

It may also store technical records such as database entries, timestamps, session tokens, device identifiers and error logs.

But local storage varies significantly between applications.

Some apps keep substantial content on the handset.

Others retain only temporary copies and rely mainly on provider systems or the cloud.

The same app may also behave differently on Android and iPhone or after a software update.

A visible screen is not the whole record.

Specialist examination may identify data in app databases, caches, shared storage, notification records or deleted areas.

But local artefacts still require interpretation.

A message shown in a database may have been received, synchronised or restored from backup.

A file in the app folder may have been downloaded automatically rather than deliberately opened.

A timestamp may represent creation, receipt, synchronisation or last modification.

The app may have removed local content while the provider retains records elsewhere.

The operational takeaway is: local app data may show content, account use and device activity, but every artefact needs context. Establish how the app created or stored it before drawing conclusions about the user.

What to check or do next¶

• Investigators should identify what the app is designed to store locally and compare it with provider, cloud and linked-device evidence.

Evidential limits¶

Do not assume that local presence proves user knowledge or intention.

Also do not assume that absence means the activity did not happen.