Does data on the phone prove the user knew it was there?¶

No. Presence may result from caching, synchronisation, backup, an attachment, indexing or another automatic process without deliberate acquisition or viewing.

Storage context explains the route¶

Identify whether the item was in a user-facing folder, app database, cache, thumbnail store, temporary area, backup or cloud container. Establish whether it was received, created, imported, restored or downloaded and whether the app normally exposed it to the user.

Look for purposeful interaction¶

Opening, editing, organising, searching, sharing or repeated playback can support knowledge more strongly than passive presence. A screenshot or user-created folder can be significant, while deletion may be manual or automatic. Even strong device interaction still requires attribution to the relevant user.