Could opening a message alter the evidence?¶

Yes. Opening a message can change both the local device and the provider-held record.

Avoid this assumption: Reading a message is passive. It may create a read receipt, update the conversation order, trigger synchronisation, load remote content or reveal activity to another user.

Before opening anything, record the notification, preview, sender, account, conversation, time and device state.

Capture the whole screen before closer detail.

Do not open the message simply to see more unless there is a clear lawful and operational reason.

Some messages contain disappearing content, remote images, links or attachments that may behave differently when opened.

Opening may also change unread counts, last-active status and account history.

If the message is already open, record the visible content and surrounding conversation without scrolling unnecessarily.

Where urgent safeguarding or threat assessment requires reading, preserve the original state first where possible and document why the action was necessary.

Record any read indicator, timestamp, alert or content change that follows.

Opening may also download remote media, load tracking pixels, reveal an IP address or trigger an automated response.

A message preview may be incomplete, but it is still part of the original state and should be preserved before access.

Record whether the message is unread, delivered, pending, disappearing, encrypted, edited or associated with an attachment.

Do not assume that a message which opens without a visible change created no provider-side record.

Operational takeaway¶

Assume opening a message creates activity and may alter its state, so preserve the preview and context before any justified access.