What Is on a Phone, and Who Can Reach It

The phone in a file is usually described as though it were a filing cabinet somebody could open. What it actually is is a window onto material stored in several places under different arrangements, and the first useful step is working out which of those places holds the thing that matters.

The three holdings

The device itself. Photographs, messages held locally, application data, and system logs recording activity. This is the smallest of the three holdings and the one people picture when they think about a phone.

Provider accounts. Message history, backups, photograph libraries, location history and application data synchronized to servers operated by the platform. This is where most of the material actually lives.

Carrier records. Call and message metadata, cell site information and subscriber details held by the network operator. It contains almost no content and a great deal of pattern.

They overlap unevenly. Some material exists in all three, some in only one, and material deleted from a device frequently persists in an account for a period nobody involved has thought about.

Identify the holding first. Because the route, the timescale and the person who has to be asked are entirely different for each, and effort spent on the wrong one produces nothing.

Reaching the device

Consent is the ordinary route. The owner produces the device or an export taken from it, which is straightforward and fast, and which depends entirely on cooperation that can be withdrawn at any point.

A forensic image preserves everything. Where the material may be contested, imaging the device rather than exporting selectively captures deleted content and system artefacts that an export never will.

Selective export raises questions. A screenshot or a partial export invites the argument that something was omitted, which is discussed in why screenshots prove little.

Encryption is a real obstacle. Modern devices are encrypted at rest, and without the passcode a great deal of material is genuinely inaccessible rather than merely difficult to extract, whatever tooling is available.

Handling changes the evidence. Simply using a phone alters logs and can trigger deletion, which is why preserving a device before it changes matters so much.

Reaching account data

The account holder can ask. Most platforms provide a download of everything held on an account, which is comprehensive, free and available within days without any process at all.

Which is the fastest route by far. Where the account holder is cooperative or is the person seeking the material, this single step usually produces more than any other in the whole exercise.

Process served on the provider. Where they are not, providers respond to compulsory process, subject to statutory rules that distinguish sharply between content and non-content records.

Content is protected more heavily. Statutory schemes generally restrict disclosure of communication content to a narrower set of circumstances than the disclosure of records about communications.

Preservation requests work. Providers will preserve account data on request pending process, which stops the ordinary deletion cycle while the paperwork is prepared.

Reaching carrier records

Almost no content. Carriers hold the fact of a call or message, its time and duration, the numbers involved and approximate location, and generally not what was said.

Which is more useful than it sounds. Pattern, timing and approximate location together establish a great deal about contact between two people, without anybody reading a single message.

Retention is short. Carriers hold detailed records for months rather than years, and cell site data for shorter periods still, so the window closes long before most disputes reach anybody's desk.

Process with notice. The route is compulsory process, and in many systems the subscriber is entitled to notice, which adds time to an already short window.

Subscriber details matter separately. Who an account belongs to, and who paid for it, are frequently the useful facts rather than anything about the traffic, and they are obtained by the same route as bank records.

Practical sequencing

Preserve first. Requests to providers and carriers to preserve identified material cost nothing and take an afternoon to send. They stop retention cycles that would otherwise destroy the material while everybody was still deciding what to do.

Ask the account holder second. Because a self-service download is faster, cheaper and more complete than anything obtainable by process, wherever cooperation is available.

Image the device before using it. Any use of a phone alters its contents, and an image taken before anybody scrolls through it preserves a position that cannot be recovered afterward.

Match the source to the question. Contact patterns come from carriers, content comes from accounts, and device artefacts answer questions about what somebody actually did with the handset itself. Asking the wrong holding produces nothing at all.

Expect gaps between sources. The same conversation looks different on a device, in an account export and in carrier records, and the differences are usually explicable rather than sinister.

The phone is a window rather than a container, and treating it as one object is what sends people down the wrong route. The message somebody wants is usually on a server, not on the handset in an evidence bag.

Cooperation is worth more here than anywhere else in evidence practice. A person willing to download their own account data produces, in a few days and at no cost, material that compulsory process would take months to extract in a less complete form.

Retention is the constraint that catches people out. Carrier records in particular are held for months, and a request made when a dispute becomes serious frequently arrives after the material has already gone.

Content and metadata are treated very differently by the statutes governing providers, and a request that does not distinguish between them is answered slowly or not at all. Knowing which is wanted shortens everything.

Finally, preservation costs nothing and buys time. A letter to a provider and a carrier identifying accounts and periods stops the ordinary deletion cycle while the substantive route is worked out.