Anatomy of a Mobile Data Depletion Incident: What the Evidence Actually Shows

# Anatomy of a Mobile Data Depletion Incident When a phone burns through 100+ GB in roughly 24 hours while the carrier header shows only a fraction of that, two questions matter: *what does the evidence actually say*, and *what does it not say yet*? This post walks through a defensive, source-cited approach to such incidents — without naming victims, without making attribution claims, and without operational detail that would help an attacker. ## Three independent evidence streams Forensic confidence rises sharply when independent sources corroborate each other. In a typical mobile depletion case, look for: 1. **Carrier usage screenshot** — the per-session itemized breakdown from the carrier app 2. **Package burn history** — top-up and bundle purchases inside the depletion window 3. **Device-side Wi-Fi / network logs** — auto-join events, BSSID, and timestamps Each stream alone can be explained away. Together, with overlapping timestamps, they become difficult to dismiss. ## What "high confidence" actually means here It is tempting to call this a confirmed attack. A careful analyst will not. Instead: - **High confidence** that the auto-join and depletion events occurred at the times the device recorded - **Medium confidence** on the causal linkage between the auto-join and the data burn, *pending* carrier session correlation and BSSID/AP attestation - **No confidence** in actor attribution without subscriber-level carrier records This is the language regulators and investigators expect. ## What to preserve - Original carrier-app screenshots with EXIF/captureTs intact - SHA-256 hashes of every preserved artifact - A redacted MSISDN reference (e.g., `0321-1857XXX`) for public reporting - A written chain-of-custody note for each artifact ## What to ask the carrier and the FIA - Per-session data records for the depletion window - Cell-site and access-point logs in the same window - Confirmation of BSSID ownership for any suspect SSID ## Why this matters Mobile data depletion is increasingly cited in harassment, surveillance, and retaliatory-conduct cases. A disciplined, defensive forensic workflow — preserve, hash, redact, request — turns a frustrated user's complaint into a filing an investigator can act on. *Published by HRPM.org — Defensive forensic awareness, source-cited and court-safe.*