What should be recorded about notifications?¶

Notifications may provide brief evidence of messages, account activity, security events or remote actions before they disappear.

Evidential caution: that opening a notification simply reveals more detail without changing anything. It may mark content as read, open an application, trigger synchronisation, reveal your activity to another user or consume disappearing content.

What this means¶

Be aware that notification previews can be incomplete or misleading. They may show only part of a message, an older cached alert or a summary generated by the operating system. Treat them as indicators, not complete records.

Where a notification suggests immediate harm, account compromise or active deletion, consider whether intervention is necessary. Preserve the visible information first if this can be done without unacceptable delay.

What to check or do next¶

• Record notifications as they appear, including the sending application, visible account or contact, preview text, timestamp, icon and any action buttons.
• Capture the whole screen first so the notification can be linked to the correct device and account. Then capture closer detail if needed.
• Record whether the device was locked or unlocked when the notification appeared. A lock-screen preview may expose content without proving that the account was actively open.
• If new notifications arrive while the device is being preserved, record that they arrived after your first observation. Distinguish the original state from later incoming activity.

Evidential limits¶

Do not expand, dismiss, clear or open notifications unless there is a specific operational reason. Even swiping them away may remove evidence that cannot easily be recreated.

Do not assume the absence of a notification means no event occurred. Notification settings, connectivity, device state and user choices all affect what is displayed.