The Phone Was at the Crime Scene. Was Its Owner There Too?

The sentence “his phone was at the crime scene” may look like a single conclusion, but it conceals several different claims. First, a particular record genuinely belongs to a particular physical device or subscriber identity. Second, that identity was in a particular geographic area at the relevant time. Third, the device belongs to person X. Fourth, person X was in fact using or at least carrying it at that moment. And fifth, if the device performed a particular action, it was person X who performed it.

The first two steps may be very well supported by technical records. The later ones require attribution. That attribution may itself be exceptionally strong — for example, if the phone had long been used exclusively by one person, was seized from that person shortly after the offence, repeatedly paired with their watch, unlocked in their presence, and if their movement is confirmed by camera footage while several independent systems record a continuous route. But the strength does not arise merely by renaming a device as a person. It arises only when the links are connected.

Time is a separate link in the chain. “At 2:13” may denote the moment when the device created an event, when an application wrote it to a database, when a server received it, or when a provider later entered it into an operational record. The phone may use a manually selected time zone, the server UTC, and the carrier its own reporting rules. Combining different timestamps into one timeline therefore first requires establishing their origin, resolution, time zone and relationship to the underlying event. For precisely this reason, the public draft of SWGDE methodology version 2.0 recommends documenting possible deviations in device time; for carrier records, the reporting of time zones must be verified separately.^[2][5] The same number in a field labelled “time” does not necessarily denote the same instant in technical terms.

A physical device is a particular piece of hardware. It may have a serial number, an IMEI and other identifiers. A SIM or eSIM is another layer: it carries or provides access to the data needed to authenticate a subscriber identity to the mobile network. A conventional UICC can be moved between phones; with an eSIM, a profile is securely downloaded to an embedded element, and one device may support several carrier profiles.^[3][4]

A telephone number, in turn, is an address for a service — not the manufacturing number of the phone or the identity of a person. It may survive a SIM replacement, a change of device or a change of carrier. One device may serve several numbers, and in some services one number may be accessible from several endpoints. A record containing a number therefore does not necessarily identify a particular piece of hardware; a record containing an IMEI, conversely, does not identify the person holding it at the time.

A user account — such as an operating-system, messaging-app or cloud-service account — adds another dimension. The account may be signed in on a phone, laptop, tablet and web client. A cloud event therefore often says reliably that the service received a request from a particular session, device, token or IP address. Without more, it does not say which human hand caused that request.

In practice, the distinction between owner and user is not resolved by one “magic” artefact. The pattern may include contacts, accounts, photographs, language, habitual routes, known Wi-Fi networks, paired devices, payment cards, unlocking behaviour, the circumstances of seizure and testimony from people nearby. Some items point to long-term use; others to possession at a particular minute. Temporal proximity is what determines whether the evidence says “X generally uses this phone” or “X was very likely operating it at the critical moment”. The first proposition is an important foundation. The second is a separate conclusion.

The public draft update to SWGDE methodology version 2.0 expressly states that artefacts from a mobile device may help establish ownership, possession and use, and that device and subscriber identifiers should be correlated with carrier data and other findings.^[2] The key word is “correlated”. A single identifier is one link in the chain, not the whole chain.

The greatest visual illusion in digital evidence arises when different kinds of data are drawn with the same symbol. A point then glows beside an address on the map whether it comes from a satellite calculation, a mobile cell, a Wi-Fi database, IP geolocation or a provider’s internal estimate. The graphical interface smooths over the differences. Yet those differences are precisely what determine the evidential meaning.

GPS—or, more precisely, GNSS —usually denotes a position estimate calculated by the device from radio measurements and, where applicable, other sensors or assistance data. A properly stored record contains more than latitude and longitude; the time, source and estimated uncertainty also matter. Android, for example, defines horizontal accuracy as a radius within which the true position is expected to lie with approximately 68% probability.^[6] The number of decimal places in a coordinate is therefore not the same thing as accuracy. The result is affected by satellite geometry, signal obstruction, atmospheric conditions and receiver quality.^[7]

Moreover, not every item labelled “location” comes directly from satellites. Mobile operating systems and applications may use a fused estimate that combines GNSS, Wi-Fi, the cellular network, inertial sensors or the last known position. The forensic meaning therefore lies not in the column heading but in which provider generated the value, whether it was a fresh measurement or an inherited state, and how the application stored it. A point on a map without those fields may look more precise than the data from which it was produced.

A mobile-network record answers a different question: which cell, and perhaps which sector, the device communicated with at the relevant time. Current SWGDE methodology describes it as a basis for placing a mobile device within an approximate geographic area. It also expressly states that CDRs alone do not persuasively identify who was using the device, and that ordinary cell or sector information cannot determine a precise intersection or address.^[5] Timing Advance may narrow the area further, but it works with a band of derived distance, not with a single point.

Wi-Fi may mean a simple list of access points visible to the phone, a record of association with a particular access point, a log from an enterprise network controller, or specialised distance measurement. Android distinguishes an ordinary scan of nearby access points from Wi-Fi RTT, in which compatible devices measure signal round-trip time and, with several known points, can estimate location much more finely.^[8] The sentence “the phone was on the Wi-Fi” is therefore incomplete until we know whether the record reflects only network visibility, an actual connection, a server log or ranging.

An IP address primarily describes a network path. A public IPv4 address may be shared by several devices in a household through NAT, and under carrier-grade NAT by several customers. The IETF therefore notes that an IP address and a time alone may not be enough to distinguish users; the source port and precise provider logs may also matter.^[10] An IP address can reliably link an event to a network egress point or access session. By itself, it will usually not reveal a room, a device or a person.

A cloud account is not a location sensor in its own right. It is a place into which data from a phone, web client, server-side inference or synchronisation may flow. A cloud record may be more valuable than a local database because it was created outside the examined device and has its own timeline. At the same time, it inherits the meaning of the original mechanism: a coordinate synchronised from a phone remains a coordinate of the device; a login from an IP address remains a session event.

Bluetooth and other proximity artefacts may confirm that two radios detected, paired with or communicated with one another. This is especially powerful when one element has a fixed location and its log is acquired independently. RSSI signal strength, however, is not a universal ruler. NIST measurements showed that device orientation, the human body, walls and the surrounding environment substantially affect the relationship between RSSI and distance; outside idealised conditions, accuracy deteriorated sharply.^[9]

Photograph metadata may contain time and geographic data under the Exif standard.^[12] What this primarily proves, however, is that the particular file contains that metadata. A conclusion about where an image was captured requires an assessment of the file’s origin, continuity, exports, edits, time settings and consistency with other traces. The same applies to application records: a database may faithfully preserve a state created by a particular version of a program, but the investigator must understand the meaning of the fields, the time source, synchronisation, and the distinction between a user event and a system event. NIST and SWGDE both warn that the meaning of an artefact may change with the software version and that an automatically assembled timeline may not contain every event.^[1][2]

Return to the phone registered in the sector near the crime scene. This information is not worthless. If the time, identifiers and carrier data align, it increases the probability that the device or subscription was within the area served. It may contradict a claim that the phone was dozens of kilometres away. It may reveal a route, a repeated pattern or contact between two devices.

By itself, however, it does not resolve every alternative. The owner may have had the phone, but so may a member of the household, a colleague or an accomplice. It may have remained in a vehicle while the person went elsewhere. The SIM may have been in another device. The account may have generated the event from a linked client. Depending on the circumstances, some explanations will be highly plausible and others merely theoretical. Forensic honesty does not mean placing them all on the same level. It means identifying the question that the isolated data point has not yet closed.

The same discipline applies in reverse. The absence of a record does not necessarily prove that a person was absent: the device may have been switched off, may not have generated the relevant network event, or may fall outside the scope of the data obtained. A digital trace is generally an answer produced by a particular mechanism. It does not automatically answer every question we would like to ask of it.

Five artefacts do not necessarily mean five pieces of evidence. A local database, a preview in a forensic tool and an export of that same database may be three views of a single event. A server record and a notification on the phone may likewise share one cause. When assessing convergence, the question is therefore not only whether the data agree, but whether they arose independently.

A stronger picture might look like this: the carrier records the device in a sector corresponding to the neighbourhood; an application on the phone stores a GNSS position with a reasonable uncertainty radius; the building’s Wi-Fi controller records an association with the same device; a camera captures a particular person arriving with the phone; a communications server receives a message from an authenticated session, and the same content appears on the recipient’s device. Each source answers a slightly different question. It is their overlap that narrows the space for alternative explanations.

Convergence does not mean that every additional point automatically multiplies certainty. If two traces share a source, or one arose from the other, their independence is limited. Even so, the principle is fundamental: an alternative explanation must gradually account not for one record alone, but for the entire set of concordant events. The more different mechanisms, data holders and timelines overlap, the harder it becomes to construct another explanation without adding further unsupported assumptions.

The strength of digital evidence does not lie in its most precise point. It lies in how many independent paths lead to the same story.

For a particular message, the evidential chain gains one more link. A local database may show an outgoing record. A server may confirm that it received the message from an authenticated session. The recipient’s phone may establish the content and delivery time. Together, that can prove very well that a particular account or client created or sent the message.

Attributing authorship to a particular person may nevertheless require further support. The account may have been open on a linked computer; someone else may briefly have controlled the device; the text may have been prepared earlier, sent by automation, dictated or inserted through remote access. NIST defines success in digital authentication primarily as demonstrating possession and control of an authenticator bound to the account.^[11] That is a highly significant fact, but it is not the same as directly observing a person at the keyboard.

At the same time, not every theoretical possibility deserves equal weight. If the message appeared in an active session on the phone, the device was with person X, a camera captured X using it, the style continues the preceding conversation, and no linked client or remote access is evident, the attribution may be very strong. The correct proposition is not “authorship can never be proved”. It is: “A conclusion about authorship must be supported by traces that go beyond the mere existence of a message in an account.”

In a forensic report, it is useful to separate at least four layers. Observation states what was found: for example, a database row, a server log or a cell identifier. Technical interpretation explains how such an artefact typically arises. Indication describes its relationship to the investigative hypothesis. And a conclusion combines several indications into a claim about a past event.

A cryptographic hash can reliably show that acquired data has not changed since a particular point in time. It does not prove that the content was truthful when it arose before acquisition, that the device clock was correct or that a particular person created the record. The chain of custody protects the integrity of evidence. Attribution analysis addresses its meaning. Confusing those two questions is as mistaken as doubting a correct hash merely because the author of the file remains unknown.

It is similarly necessary to distinguish admissibility from evidential weight. A correctly acquired and authentic export may be an entirely proper item of evidence while still supporting only a limited claim — the presence of an account in a system, for example, rather than the identity of the author. Conversely, a substantively persuasive artefact may be weakened by uncertain provenance or an undocumented transformation. An honest expert opinion therefore states not only the finding, but the path by which it was reached, known limitations, and the degree to which it supports a particular hypothesis. NIST describes this transition as analysis that turns artefacts into a reconstruction of relevant events; the reconstruction is an expert result, not an automatic tool output.^[1]

The Czech Constitutional Court has repeatedly emphasised that circumstantial evidence is not inferior to direct evidence. It may itself be sufficient to establish guilt if the individual pieces are interconnected and form a coherent chain that leaves no reasonable alternative.^[13] Digital artefacts fit this logic exactly. Individually, they may prove partial circumstances. Taken together, they may create a highly persuasive reconstruction. The decisive question is whether a hidden gap remains between the observed data and the final conclusion.

Any evidence can be surrounded by hypothetical possibilities. The phone might have been lent out. The account might have been compromised. The camera might have captured a lookalike. The time might have been wrong. If the mere conceivability of an alternative were enough, almost nothing could be proved — digitally or otherwise.

A reasonable alternative must have support in the circumstances, explain the entire body of traces, and not require an ever-growing series of unsupported exceptions. Evidence that two people in a household routinely shared the phone carries a different weight from the purely theoretical statement that “anyone could have had it”. A documented active session on a laptop carries a different weight from the possibility that “perhaps somebody hacked the account” when the logs show nothing of the kind.

Forensic precision is therefore not an endless list of every imaginable scenario. It is a calibrated assessment: what a trace directly proves, what it strongly supports, what it merely permits, and which alternatives remain realistic. This approach does not weaken digital evidence. It strips away exaggerated claims that might collapse at the first serious expert challenge.

At the start of the case, the proposition sounded simple: “His phone was near the crime scene.” Once context is added, an honest conclusion may sound less dramatic but be substantially more precise: “The subscriber identity registered to person X used, during the critical period, a sector covering the surrounding area. Further artefacts from a particular device, an independent Wi-Fi log and video footage support the conclusion that person X was holding the device at the time.”

That wording is not an evasion of a decision. On the contrary, it shows which parts of the conclusion rest on a direct technical record, which on a pattern of use, and which on the convergence of independent evidence. If a message sent from the account is later added, a different question must be asked again: are we proving session activity, control of the phone, or authorship by a particular person?

Digital technology has not created a world without uncertainty. It has created a world with an enormous quantity of traces — often more precise, more finely timed and more resistant to the failures of human memory than anything investigators had before. Their value is greatest precisely when we respect the boundaries of each mechanism and allow different sources to verify one another.

The greatest problem therefore often lies not in a shortage of data, but in language. In a single sentence, we can turn technically precise data into a human story more precise than the data permits. And the most dangerous forensic error need not occur when the trace is inaccurate. It may occur when the trace is precise — and our conclusion is more precise still.