What is a mobile-device backup?¶
A mobile-device backup is a stored copy of selected device data and settings that can be used to restore or replace a phone or tablet.
What this means¶
The backup may be held in the cloud, on a computer or in another managed system.
It may include contacts, messages, photographs, settings, app data, device configuration and account information.
But a backup is not necessarily a complete copy of the handset.
Some data may be excluded because it already synchronises separately.
Some applications may prevent their data from being backed up.
The content also depends on when the backup last ran.
A deleted item may remain in an earlier backup even though it is gone from the handset.
Restoring a backup can also place old material onto a new device, creating records that did not originate there.
This matters for attribution.
A photograph or message found on a handset may have arrived through restoration rather than being created on that device.
That would alter the handset.
Where lawful and appropriate, obtain or examine the backup separately.
The operational takeaway is: a backup is a time-limited copy of selected device data, not a perfect duplicate. Establish when it was created, what it included and whether it was later restored before interpreting the contents.
What to check or do next¶
- Investigators should identify the backup date, source device, account, storage location and restore history.
- Do not restore a backup onto the evidential device to see what appears.
Evidential limits¶
Encrypted or temporary material may not be included.
A recent device action may not appear if the backup is older.