Mobile evidence guidance
What can be established when a phone has been reset or reused?
Reuse alone does not establish a factory reset. A confirmed modern factory reset usually destroys access to the previous encrypted local data. Post-reset reuse then creates a new evidential period. The investigation should separate pre-reset, reset and post-reset events and identify external sources that may preserve the earlier history.
Potential evidence sources
Where relevant records may exist.
- Current reset or reused handset
- iCloud, Google or manufacturer backups
- Application-specific backups
- Linked computers and tablets
- Recipient or group-participant devices
- Contemporaneous exports, photographs and account records
Decision factors
What materially changes the prospects.
- 01Exact reset date and method
- 02Whether the device was subsequently reused
- 03Backup dates and retention
- 04Application cloud and synchronisation behaviour
- 05Availability of linked or counterpart evidence
Separate the periods before drawing conclusions.
- 01Establish whether a reset actually occurred. Reassignment or continued use alone is not proof.
- 02If confirmed, distinguish pre-reset records, the reset event and post-reset activity. Do not infer earlier intent from current absence.
- 03Assess independent earlier backups, account records, exports and counterpart devices by date and scope.
- 04Record unresolved chronology and source gaps, including what the available evidence cannot establish.
Evidential limitations
What must not be overstated.
Post-reset local activity does not restore historic encryption keys
A reset date may require correlation rather than one definitive record
Absence of historic content on the reused phone is expected and does not prove earlier deletion intent
Sources and interpretation
Each entry identifies its limited supporting proposition and documentation-check date. General methodology is not a current device-support list. These checks are not laboratory validation; availability and method suitability require assessment for the exact source and configuration.
- Apple iCloud data protection
Configuration changes encryption and key availability.
Platform documentation · Documentation checked
- What iCloud backs up
Synchronised content and device backups are distinct.
Platform documentation · Documentation checked
- NIST mobile device forensics guidance
Methodological background (2014), not a current device-support list.
General methodology · Documentation checked
Confidential case review
