How do I distinguish device evidence from provider evidence?¶

Label each record by the system that created it: device evidence describes what local hardware recorded, while provider evidence describes what a network, app, account or cloud service recorded.

The sources observe different stages¶

A handset may retain message databases, photographs, notifications, app state and local timestamps. A provider may record registration, sessions, network addresses, delivery, security or deletion events. Local creation, server receipt and later synchronisation can therefore produce different times for the same activity.

Reconcile without merging provenance¶

Compare account, message, device and session identifiers and establish what triggered each timestamp. One source may preserve activity deleted from the other, while unsynchronised local data may never reach a provider. A disagreement is a question to investigate, not a reason to silently prefer one record.