Nicosia, Cyprus. Police investigations into contested digital evidence in the Sandy case widened after forensic findings raised new inconsistencies. Authorities are seeking a secondary mobile phone after examination showed the device handed over did not match the timeline under investigation.
Forensic findings and timeline discrepancies
Authorities said three deleted applications used to generate messages were identified on the device handed over by the woman known as Sandy. The applications were installed on October 10, 2025, January 1, 2026 and March 13, 2026, dates that do not correspond to the period in which the alleged offences are said to have been relayed between 2019 and the present.
Search for a second device
Sandy has reportedly retracted her initial stance and told investigators she created “hundreds of SMS messages” herself and handed over a phone to support that claim. She later said she had provided “another device” and that the original had been given to a third party “with the intention of keeping it.” Investigators are continuing efforts to locate that device.
Evidence sent to Europol
Police spokesman Vyron Vyronos said “the most serious aspect of the entire investigation” remains the authentication of the material and confirmed that all evidence has been submitted to Europol for forensic analysis.
Potential charges and expanded inquiry
Authorities have indicated that a criminal case is being prepared, with reports suggesting Sandy could face multiple charges including preparation, possession and circulation of forged documents and conspiracy to commit a crime.
The investigation has expanded following searches of the home and office of lawyer Nikos Clerides, who had received the material. Officers seized three mobile phones, returning one after copying its data while retaining the others under evidential orders.
What do you think should be the next step for investigators in verifying the authenticity of the digital material?
