What does synchronisation mean?¶

Synchronisation is the process of keeping data consistent across devices, applications and cloud services.

What this means¶

A change made in one place may be copied to others.

A photograph taken on a phone may appear on a tablet.

A contact edited on a laptop may update on the handset.

A message read on one device may show as read everywhere.

It may have arrived through synchronisation from another device or account session.

Deletion can also synchronise.

Removing a message, photograph or file on one device may remove it from others, depending on the service.

Synchronisation may be immediate, delayed or partial.

It can depend on connectivity, battery settings, account status, app permissions and provider design.

Timestamps may also reflect different events.

One system may record when the content was created.

Another may record when it synchronised or was modified locally.

Which account was synchronising?

Which devices were linked?

What data types were enabled?

When did each device last connect?

Did the change originate locally or elsewhere?

It may be one event copied automatically.

Equally, differences between devices may reflect delayed or failed synchronisation rather than deliberate deletion.

The operational takeaway is: synchronisation moves and updates data across the account environment. Establish the source event, linked devices and timing before deciding where activity originated.

What to check or do next¶

• Investigators should ask:

Evidential limits¶

This matters because content visible on a device may not have been created there.

Do not assume that matching content on several devices proves several separate actions.