What alternative names, usernames and identifiers should I search?¶
title: What alternative names, usernames and identifiers should I search? subtitle: Build an identity map from known records and expand it as the extraction reveals new links. slug: what-alternative-names-usernames-and-identifiers-should-i-search series: mobile-extraction-and-reader-reports section: searching-and-preserving-results card_type: question_card content_type: core-operational risk_level: normal pathway_order: 16 section_order: 3 status: draft owner: IF Digital last_updated: '2026-07-25' version: '0.1' review_gate: pending review_mode: ai-assisted review_timebox_mins: 30 qa_gate: pending qa_count: 0 pipeline_ref: PIPELINE_PRG_001 pipeline_version: '1.1' public_safe: true video_ready: true word_count: 562 estimated_read_time_seconds: 233 audiences: - investigator - supervisor - fraud and compliance practitioner tags: - mobile evidence - identifiers - usernames - aliases - identity map sources: - title: SWGDE Best Practices for Mobile Device Forensic Analysis url: https://www.swgde.org/documents/published-complete-listing/20-f-005-swgde-best-practices-for-mobile-device-forensic-analysis/ - title: 'Cellebrite Reader: UFDR Report Viewer for Investigators' url: https://cellebrite.com/en/products/cellebrite-inseyets/reader/ - title: 'Magnet Forensics: Portable Case for evidence review' url: https://www.magnetforensics.com/blog/the-power-of-portable-case-unleashing-evidence-discovery-for-all-investigators/
What alternative names, usernames and identifiers should I search?¶
Build an identity map from known records and expand it as the extraction reveals new links.
Script¶
A useful mobile-report search begins with an identity map.
That is a list of the different ways a person, account, organisation or device may appear in the data.
Start with verified identifiers from existing records.
For a person, that may include:
full name;
shortened name;
nicknames;
former names;
common misspellings;
telephone numbers;
email addresses;
social-media handles;
messaging usernames;
account IDs;
addresses;
vehicle registrations;
business names;
and known profile images or avatars.
For an organisation, include trading names, company names, domains, support addresses, telephone numbers and account references.
For an online account, preserve the exact username, display name, numeric user ID, profile URL and registered contact details where known.
Search each identifier separately before combining them.
This tells you which value produced the result.
A broad search for several terms at once may be convenient, but it can make a negative result difficult to explain.
Now consider variations.
Names may be stored with initials, titles, reversed order or missing spaces.
Usernames may include numbers, underscores, punctuation or different capitalisation.
Some search tools ignore case while others treat punctuation differently.
Test the report rather than assuming its matching behaviour.
Look for identifiers that are not visible to the ordinary user.
Applications commonly use internal numeric IDs, globally unique identifiers, contact keys, conversation IDs and package names.
A reader report may expose some of these in artefact details or source fields.
They can be extremely useful because they remain stable when a display name changes.
But don’t assume that an internal ID has the same meaning across different applications.
An ID is meaningful within the system that created it.
Use the extraction to expand the map.
A contact record may connect a name to a number.
A chat artefact may connect the number to an application account ID.
A profile record may connect that account to an email address.
A browser login may reveal another username.
Record the source of every new link.
Separate known identifiers from inferred identifiers.
For example:
“Known from provider records: this telephone number.”
“Found in the extraction: the number was labelled ‘Steve Work’.”
“Found in the application database: the same account record used this internal user ID.”
That makes the reasoning transparent.
Be careful with shared identifiers.
A family telephone number may be used by several people.
A business email address may be operated by a team.
A device name may be copied during setup or restored from a backup.
A profile image may be reused.
An identifier establishes an association, not automatic exclusive control.
Also search distinctive content where appropriate.
A repeated phrase, unusual spelling, address fragment or reference number may connect accounts that use different names.
Treat stylistic similarity as a lead rather than proof of authorship.
The common mistake is to create one large list of speculative aliases and then report every match as connected to the suspect.
Each identifier needs a basis.
Another mistake is to search only the identifiers known before reviewing the device.
Mobile evidence often reveals the next useful account, number or handle.
A good identity map therefore has three columns:
identifier;
source;
status.
Mark an item as verified, reported, inferred or unconfirmed.
Update it as the enquiry develops.
Then search consistently across relevant devices and reports.
The goal is not to find the person’s name everywhere.
It is to identify the accounts, numbers and records that can be linked through explainable evidence.
Key takeaway
Search known identifiers, plausible variations and tool-discovered identifiers separately so you can explain how each link was made.
Related questions¶
- Why is searching only for the suspect’s name unreliable?
- How should I search for telephone numbers?
- How should I search for email addresses?
- How do I record where an artefact came from?
Source notes¶
- SWGDE Best Practices for Mobile Device Forensic Analysis
- Cellebrite Reader: UFDR Report Viewer for Investigators
- Magnet Forensics: Portable Case for evidence review