How do I build a mobile-device attribution investigation?¶

Build a time-specific chain from device, subscription and account activity to the person alleged to have controlled it; none of those technical objects is a person by itself.

Establish each link¶

Map the handset and its identifiers, SIM/eSIM and number, ecosystem and app accounts, sessions and linked devices. Place possession, unlocks, logins, calls, messages, app use, location and provider events on the same time basis. Test changes such as replacement devices, SIM swaps, number porting, sharing, remote access and account compromise.

Add the human evidence¶

Use CCTV, witnesses, transactions, travel, workplace records and communications to connect technical activity to an operator. Subscriber, owner and registration details are starting points. State precisely which links are established, for what period, and which realistic alternative explanations remain.