Which mobile evidence is most likely to disappear quickly?¶
Live sessions, decrypted access, notifications, clipboard, cache, temporary files and short-retention provider records are especially vulnerable.
Device state can change without handling¶
Lock, restart, power loss, background activity and storage reuse can remove evidence. Remote commands and linked-device synchronisation can alter messages, media and account state. Investigator interaction can create read, timestamp and sync changes.
Prioritise by loss risk and value¶
Record power, lock, screen, battery, connectivity and notifications before action. Seek urgent specialist advice for live access or remote change and use authorised provider preservation for short-retention records. Do not press through menus simply because evidence is volatile.
Device and provider evidence should remain separately sourced while urgent preservation proceeds.
Key takeaway
Identify the highest-value short-lived state first, preserve it proportionately and document every change made under time pressure.
