What should I do when mobile evidence conflicts with another account?¶
title: What should I do when mobile evidence conflicts with another account? subtitle: Preserve both accounts, identify the precise conflict and test whether the records describe different events, times or perspectives. slug: what-should-i-do-when-mobile-evidence-conflicts-with-another-account series: mobile-extraction-and-reader-reports section: evidential-limits-corroboration-and-supervision card_type: question_card content_type: core-operational risk_level: high-risk pathway_order: 59 section_order: 9 status: draft owner: IF Digital last_updated: '2026-07-25' version: '0.1' review_gate: pending review_mode: ai-assisted review_timebox_mins: 60 qa_gate: pending qa_count: 0 pipeline_ref: PIPELINE_PRG_001 pipeline_version: '1.1' public_safe: true video_ready: true word_count: 469 estimated_read_time_seconds: 194 audiences: - investigator - supervisor - fraud and compliance practitioner tags: - mobile evidence - conflicting evidence - witness account - timeline - investigative reasoning sources: - title: 'Forensic Science Regulator: Interpretation and Communication (FSR-GUI-0004)' url: https://www.gov.uk/government/publications/forensic-science-activities-interpretation-and-communication-fsr-gui-0004 - title: SWGDE Best Practices for Mobile Device Forensic Analysis url: https://www.swgde.org/documents/published-complete-listing/20-f-005-swgde-best-practices-for-mobile-device-forensic-analysis/ - title: 'NIST SP 800-101 Rev. 1: Guidelines on Mobile Device Forensics' url: https://csrc.nist.gov/pubs/sp/800/101/r1/final
What should I do when mobile evidence conflicts with another account?¶
Preserve both accounts, identify the precise conflict and test whether the records describe different events, times or perspectives.
Script¶
Mobile evidence may conflict with a witness, suspect, victim, provider record or another device.
Don't assume that the technical record must win.
Don't assume that a sincere human account makes the digital evidence wrong.
Define the conflict precisely.
Is the disagreement about:
whether an event occurred;
which account was involved;
which device created it;
the time;
the location;
the person using the handset;
or the meaning of the content?
Vague statements such as “the phone contradicts them” hide the real issue.
Preserve both sources before trying to reconcile them.
Keep the original interview or account.
Preserve the mobile artefact, source path, extraction, timestamp basis and report settings.
If another device or provider record is involved, preserve that material as well.
Then check whether the sources describe the same event.
A witness may remember when they read a message, while the report shows when the provider delivered it.
The phone may show a cloud-synchronised message created on another device.
A location artefact may record a searched destination rather than device position.
A file time may record import rather than creation.
The apparent contradiction may disappear once the event definitions are aligned.
Check timing carefully.
Was the device clock wrong?
Were UTC and local time confused?
Did the account synchronise later?
Was the person estimating time from memory?
Use ranges where either source lacks precision.
Now test technical limitations.
Is the parser interpretation secure?
Was the application version supported?
Was the record active or recovered?
Does the source database contain enough fields?
Could another tool or provider record validate it?
Then test the human account fairly.
Did the person have an opportunity to observe the event?
Was their account given before they knew the technical findings?
Are there internal inconsistencies?
Could stress, delay, misunderstanding or ordinary memory error explain the difference?
Is there evidence of deliberate deception?
Avoid confirmation bias.
An investigator who expects the phone to prove guilt may overread an ambiguous artefact.
An investigator who accepts a familiar witness may dismiss a valid technical contradiction.
The Forensic Science Regulator’s interpretation guidance emphasises careful communication of observations and inferences.
Keep those separate.
The common mistake is:
“Digital evidence does not lie.”
Digital systems can record accurately while the investigator misunderstands what was recorded.
Another mistake is:
“The witness is credible, so the phone must be wrong.”
Credibility and technical validity are separate questions.
A careful report might say:
“The witness recalls opening the message at approximately 20:00. The provider records delivery at 19:42, while the handset records local access at 20:06. These records describe different stages and are not necessarily inconsistent.”
Where the conflict remains, say so.
Identify which explanation is best supported and which uncertainty matters to the decision.
Conflicting evidence should sharpen the question, not force an immediate choice between human and machine.
Key takeaway
A conflict is a reason to examine source, timing and alternative explanations—not to choose the technical record or witness automatically.
Related questions¶
- How should I deal with missing or impossible-looking times?
- Could an application database or forensic parser be incomplete or wrong?
- What corroboration should I look for before attributing mobile evidence?
Source notes¶
- Forensic Science Regulator: Interpretation and Communication (FSR-GUI-0004)
- SWGDE Best Practices for Mobile Device Forensic Analysis
- NIST SP 800-101 Rev. 1: Guidelines on Mobile Device Forensics