Should a witness forward messages or files to the investigator?¶

A witness should not automatically forward messages or files where doing so may alter, strip or replace important evidence.

Avoid this assumption: Forwarding creates a faithful copy. It may remove headers, metadata, original filenames, conversation context, account identifiers or provider timestamps.

Forwarding can also change read status, create a new message record, alert another user or expose sensitive material through an unsuitable channel.

First preserve the original device, account and message as found.

Record the service, sender, recipient, account, date, time, attachments, status indicators and surrounding conversation.

Where a copy is needed urgently, use an approved method and record exactly how it was created and transmitted.

Do not ask the witness to download an attachment, open a disappearing message or follow a link merely to make it easier to send.

For email, an original message file or provider export may preserve more detail than ordinary forwarding.

For messaging, screenshots may assist but should not replace specialist capture or provider records where those are needed.

Record whether the witness added text, cropped images, changed filenames or converted the file.

Preserve the received copy separately from the original source and label it clearly as a derivative.

Do not assume the forwarded item proves the original account, time or sender without corroboration.

Record whether the original message remains available after forwarding and whether the receiving system changed its filename, format or visible timestamps.

Operational takeaway¶

Avoid routine forwarding where it may strip context or create new activity, and preserve the original source before obtaining a clearly documented derivative copy.