What is a mobile cloud account?¶
A mobile cloud account is the main online account used to connect a device with services beyond the handset.
What this means¶
On an iPhone, this is commonly an Apple account.
On an Android device, it is commonly a Google account, although manufacturers may also provide their own services.
The account may support backups, photographs, contacts, calendars, app downloads, device location, password storage, synchronisation and linked-device management.
It may also allow the user to locate, lock or erase the handset remotely.
This makes the cloud account a separate evidence source.
The physical phone may contain one set of records.
The cloud account may contain backups, synchronised content, security events, trusted devices and activity from other devices.
A family, workplace or shared device may use an account registered to somebody else.
Several people may also know the credentials or have access through an already trusted device.
The account may remain linked after the handset is sold, lost or replaced.
Then ask what services were enabled and what records may exist with the provider.
The operational takeaway is: the mobile cloud account connects the device to backups, synchronisation and remote services. Investigate it separately from the handset and attribute its use through account, device and contextual evidence.
What to check or do next¶
- Investigators should identify the account email, account ID, recovery details and linked devices where lawfully available.
- Do not change passwords, sign out devices or access the account informally. Those actions may alter evidence or alert users.
Evidential limits¶
Do not assume that the cloud account holder was the only person using the handset.