Evidential scenario
A phone was used by more than one person
Device ownership is not the same as authorship. The examination should reconstruct access, user activity, account sessions and surrounding conduct for the relevant times.
Questions to resolve
Establish the fact base.
Q1
Who knew the passcode or had biometric access?
Q2
Were accounts shared or separately authenticated?
Q3
What independent activity brackets the disputed messages?
Immediate actions
Preserve the available routes.
A1
Build a device and account access chronology
A2
Correlate application, system and location artefacts
A3
Test alternative users fairly
A4
Separate fact from attribution opinion
Interpretation risks
Avoid premature conclusions.
Assuming the owner authored every message
Ignoring shared credentials
Expressing attribution more strongly than the evidence allows
Confidential case review
