Mobile Forensics · Cloud & Account Evidence · Lesson 1 of 5

Phone vs Cloud

Sort phone data into device-only, synced and backed up, and see why it matters.

Three places data can live

A phone in an evidence bag is only part of the picture. Much of what a person does on a phone also lives on a company's servers, tied to an account such as an Apple Account or a Google Account. Investigators sort a phone's data into three rough groups.

Device-only data stays on the phone and never leaves it. App developers can choose to keep some data out of backups, and caches and temporary files usually aren't copied anywhere. Some services now keep sensitive data local on purpose. Google Maps Timeline, for example, now saves visits and routes on each signed-in device, with an optional encrypted backup.

Synced data is kept the same across the phone, the account and the person's other devices. iCloud Photos, Messages in iCloud, Google Contacts and Gmail all work this way. Sync is live, so changes travel in both directions. Apple says that when you delete a photo in the Photos app with iCloud Photos on, it's deleted on every device signed in to that account. It sits in a Recently Deleted album for 30 days first.

Backed-up data is a snapshot, a copy of the phone at a moment in time, kept so it can be restored onto a new phone. You met iCloud Backup in iOS Internals: it runs about once a day while the iPhone is charging, locked and on Wi-Fi, and it covers data that doesn't already sync, such as app data, settings and the Home Screen layout. On Android, backup by Google One covers apps and app data, call history, contacts, device settings, and SMS and MMS messages, with photos and videos handled separately by Google Photos.

The difference matters. A synced item usually disappears everywhere when it's deleted. A backup taken before the deletion may still hold the old copy until the next backup replaces it.

Why the cloud and the phone disagree

Because sync and backup work differently, the phone and the cloud rarely hold exactly the same data. Each can have things the other has lost.

The cloud can hold data the phone no longer has:

• A backup made last night still contains messages deleted from the phone this morning, if those messages weren't syncing separately.
• An old backup from a previous phone may survive after that phone was lost, broken or reset.
• Synced data stays in the account after the phone itself is wiped, because wiping a phone doesn't delete the account.

The phone can hold data the cloud doesn't have:

• Device-only data, such as files an app keeps out of backups.
• Anything created since the last backup ran.
• Data whose backup has expired. Google says that if you don't use your device for 57 days, the backed-up data (except photos and videos) is erased. Apple says that if you turn off iCloud Backup for a device, its stored backups are kept for 180 days before being deleted.

For an investigator, this means the phone and the account are separate sources that can fill each other's gaps. They're also usually reached in different ways. The phone is examined in a lab under a warrant, with consent, or because an organization owns it. The account sits with a provider, and getting data from it normally means the account holder downloads it with consent or the provider responds to legal process. You'll see both routes in the next two modules.

Timing matters too. Because backups expire and get replaced, waiting can mean losing a copy. Later in this course you'll meet the request that asks a provider to hold on to data while paperwork is prepared.