What is the difference between the device account and an individual app account?¶

The device account is the main account used by the operating system.

What this means¶

An individual app account belongs to a particular service.

For example, a phone may use one Apple or Google account for backups, app downloads and synchronisation, while separate accounts are used for messaging, social media, banking and email.

These accounts can belong to different people.

A shared tablet may use one household device account while each user signs into separate app accounts.

A work phone may use an employer-managed device account with personal app accounts added later.

The records also sit in different places.

The device-account provider may hold trusted-device, backup, security and synchronisation records.

The app provider may hold separate registration, login, content and session data.

The handset may contain local artefacts from both.

Which account controls the device?

Which accounts are used inside apps?

Which recovery email or telephone numbers link them?

Which devices and sessions were active?

This mapping can reveal shared use, account switching, compromise or activity from another device.

The operational takeaway is: the device account manages the handset ecosystem, while app accounts manage individual services. Treat each as a separate identity and establish how they were linked at the relevant time.

What to check or do next¶

• Investigators should map the account layers.

Evidential limits¶

This matters because one account does not automatically identify the others.

Finding a Google account on an Android phone does not prove who used every installed app.

Finding a messaging account does not prove who controlled the main cloud backup.