Dodgy Dave gives one phone three SIMs and calls it three businesses¶

Dave coordinates deliveries of counterfeit goods through three supposed wholesalers. Each has a different number and account name. All three are operated from the same inexpensive handset, because Dave has mistaken changing the SIM for changing the phone. This standalone scenario follows the mobile evidence created by his rotating identities.

Dave creates three extremely independent wholesalers¶

Dave advertises counterfeit clothing through accounts north_style, urban_crate and label_lane. One physical SIM and two eSIM profiles provide different contact numbers. Dave refers to the accounts as separate “departments”, although the department meeting is usually his left hand passing the handset to his right.

The handset, number and account are separate things. Changing one can be meaningful without changing the others. The network sees subscriptions using a device; application providers see accounts and installations using their services; the phone may retain local traces from all three.

The network notices that the phone has not changed¶

Each subscription is used by IMEI ending 3386 during the relevant delivery period. An IMEI identifies mobile-network hardware; it does not name Dave. The recurring value is nevertheless a strong link between numbers that were presented as unrelated.

SIM and subscription identifiers show which service was active; the IMEI shows the device relationship. The records support the proposition that the three numbers were used through one handset. They do not yet prove who held it.

Dave changes account names but keeps the working machinery¶

The sales platform records distinct account IDs, but two use app installation INST-9082; the third is added after a reinstall and uses INST-1137. A changed installation identifier does not make the earlier link disappear. Device model, account-recovery events, recurring delivery references and relevant-time network records still overlap.

App and provider identifiers may change after reinstall, reset or account change. Some mobile identifiers are stable and others are not. Good analysis explains the lifespan of each value and uses the surrounding evidence rather than inventing one universal device token.

The handset becomes a small warehouse office¶

When lawfully recovered with counterfeit stock, DX-41 contains all three sales accounts, cached product photographs, notification fragments and delivery-address searches. A mobile cloud account holds a backup made between the second and third SIM changes. Local app evidence and cloud backup evidence overlap without being identical copies.

Dave deletes two conversations and one app. Deleting an app may leave local data and does not delete provider or recipient records. More importantly, the case does not depend on promising that deleted material will always be recovered. The handset already connects the accounts, subscriptions, orders and stock through positive surviving evidence.

Dave's delivery records supply the human layer¶

Courier collections for all three trading names repeatedly begin near Dave's lock-up. Collection references appear in the phone's notifications and platform records. Footage shows Dave handing over two packages; a third collection is made by another person using order reference LL-208.

The result is a strong circumstantial combination. Network records link the changing subscriptions to one handset. Platform records connect accounts and installations to particular orders. The recovered phone carries corresponding local and cloud artefacts. Courier footage and stock connect the digital pattern to Dave while creating a sensible line of enquiry towards the second collector.