Skip to content
Skip to main content
Mobile Devices & Apps Technical Explainer

What evidence might an app store locally?

An app may store content, account configuration and technical artefacts in databases, files, cache, notifications and shared storage on the handset.

Local records vary by design and platform

Possible material includes messages, media, drafts, searches, contacts, settings, location, usage, timestamps, tokens, identifiers and errors. Some apps retain substantial histories; others hold temporary representations and depend on providers. Android, iOS and app versions can differ.

Presence requires mechanism-based interpretation

A database message may have been received or restored. A file may download automatically. A timestamp may represent creation, synchronisation or modification. Visible absence may reflect local deletion while provider records remain.

Identify how the specific app produces and stores each artefact, then compare provider-held evidence and linked devices. Local presence does not automatically prove knowledge or intention, and local absence does not disprove service activity.

Key takeaway

Interpret local app artefacts through their storage mechanism, version and event meaning before using them as evidence of user action.

Reference: MDA-051Mobile Devices & Apps