What is cached app data?¶

Cached app data is information stored temporarily so the app can load faster or continue working with limited connectivity.

What this means¶

It may include images, message previews, web content, thumbnails, map tiles, account details or recently viewed material.

The key word is temporary.

Cached data may be created automatically and may be removed or replaced without the user doing anything.

An image may appear in cache because it was displayed in a feed, received in a message preview or downloaded in the background.

A cached webpage may reflect automatic loading rather than intentional browsing.

But cache can still be evidentially useful.

It may show that content was available to the app, indicate recent service use or preserve material no longer visible through the normal interface.

The meaning depends on how the particular app creates and manages its cache.

Cache may also survive after content is deleted from the app or account.

Conversely, clearing cache may remove useful local traces while leaving provider records untouched.

The operational takeaway is: cached data is an automatic working copy, not proof of deliberate possession or use. Treat it as a lead and interpret it alongside the app’s behaviour and other evidence.

What to check or do next¶

• Investigators should avoid broad statements such as “the user downloaded this” unless the artefact actually supports that conclusion.
• Look for supporting records such as view history, message status, user actions, timestamps, downloads or provider logs.

Evidential limits¶

Its presence does not automatically prove that the user deliberately saved, opened or understood the content.