Mobile evidence guidance
Can an examiner prove who sent a message?
The displayed name or profile photograph is not enough. Attribution requires correlation between account identifiers, device control, login or session activity, surrounding conduct and corroborating evidence.
Potential evidence sources
Where relevant records may exist.
- Internal account and message identifiers
- Device ownership and usage records
- Linked-session and account-change artefacts
- Contact and profile history
- Network, cloud or provider records where lawfully available
- Counterpart communications and conduct
Decision factors
What materially changes the prospects.
- 01Who possessed and could unlock the device
- 02Whether accounts were shared or compromised
- 03Profile changes and impersonation
- 04Timing of related device activity
- 05Independent corroboration
Evidential limitations
What must not be overstated.
Account attribution is not automatically human authorship
Shared devices and stolen credentials create alternative explanations
Conclusions may need to be expressed by degree rather than certainty
Sources and interpretation
Each entry identifies its limited supporting proposition and documentation-check date. General methodology is not a current device-support list. These checks are not laboratory validation; availability and method suitability require assessment for the exact source and configuration.
- NIST mobile device forensics guidance
Methodological background (2014), not a current device-support list.
General methodology · Documentation checked
- NIST IR 8354: Digital Investigation Techniques, final scientific foundation review (2022)
Methodological background: discovery is not exhaustive and changing software can change artefact meaning. Not a device-support list.
General methodology · Documentation checked
Confidential case review
