Can an app run or communicate in the background?¶

Yes. Many mobile applications can continue working when they are not visible on the screen.

What this means¶

They may receive messages, update content, upload photographs, collect location, refresh account data or communicate with a provider.

That background activity may be controlled by the app, operating system, user settings, battery restrictions and permissions.

An app may contact its provider to check for updates.

It may send a notification token, synchronise messages or upload data automatically.

Some activity may continue after the screen is locked.

Other activity may be delayed until the device reconnects to Wi-Fi, begins charging or the operating system allows it to run.

The app’s design also matters.

Equally, do not dismiss background activity as irrelevant. It may help establish account status, device presence, synchronisation or service use.

The operational takeaway is: apps can create network and device records without being visibly opened. Establish whether the event resulted from user interaction, background processing or automatic synchronisation before attributing it.

What to check or do next¶

• Investigators should distinguish between active use and background processing.
• Look for screen-use records, app-opening events, user interaction, message status, timestamps and provider records.

Evidential limits¶

This matters because a network connection or local record does not automatically prove that the user opened the app at that moment.

A background location record may show that the device allowed the app to obtain location, but it does not by itself prove that the user deliberately opened the service or knew the record was created.

Do not assume that every outbound connection represents a conscious action.