What evidence might an app store locally?¶
An app may store content, account configuration and technical artefacts in databases, files, cache, notifications and shared storage on the handset.
Local records vary by design and platform¶
Possible material includes messages, media, drafts, searches, contacts, settings, location, usage, timestamps, tokens, identifiers and errors. Some apps retain substantial histories; others hold temporary representations and depend on providers. Android, iOS and app versions can differ.
Presence requires mechanism-based interpretation¶
A database message may have been received or restored. A file may download automatically. A timestamp may represent creation, synchronisation or modification. Visible absence may reflect local deletion while provider records remain.
Identify how the specific app produces and stores each artefact, then compare provider-held evidence and linked devices. Local presence does not automatically prove knowledge or intention, and local absence does not disprove service activity.
Key takeaway
Interpret local app artefacts through their storage mechanism, version and event meaning before using them as evidence of user action.