How do I link a device, account, number and person?¶
Create an evidence map that shows each claimed link, its source and the period for which it is supported.
Move through the technical layers¶
Start with the physical device, its identifiers and possession. Network records can associate a number and SIM/eSIM with a handset at a relevant time. App and device-account records can then connect accounts, installations, sessions, trusted devices, recovery details and network addresses.
Prove control at the relevant moment¶
Possession, passcode knowledge, habitual use, payments, photographs, messages, location, CCTV and witnesses may connect those layers to a person. Test whether the device was shared, the number moved, the account was accessed elsewhere or control changed. Registration identifies an administrative relationship, not necessarily the operator.
Key takeaway
Attribution is strongest when independent records overlap in time across device, subscription, account, session and human control.