When is a mobile-device line of enquiry worth pursuing?¶

Pursue it when a defined device, account, number, app or provider source has a realistic and proportionate prospect of answering a material question.

Start with the proposition¶

Identity, attribution, communication, movement, knowledge, association, timing, intent or access may justify the enquiry. Identify the relevant period, the source most likely to hold the answer, the records expected and how either result would change the investigation. Consider handset, provider, cloud, app and linked-device evidence separately.

Balance value, urgency and scope¶

Volatile device state and short provider retention may make a focused enquiry urgent. Conversely, speculative attribution, an undefined period or unlikely records can make broad examination disproportionate. A phone's availability alone does not justify a full extraction that creates delay and irrelevant material.