When may a native export be sufficient?¶

A native export may be sufficient when it preserves the relevant material, metadata and account context needed to answer the investigative question.

Avoid this assumption: Every case requires seizure or full forensic acquisition. In some circumstances, an approved export from the service or application may be proportionate and reliable.

Assess what the export contains. It may include message text, attachments, headers, timestamps, account identifiers, audit records, file structure or version information.

Record the service, account, export method, date, time, operator, scope, filters, format and any provider-generated reference.

Preserve the original export file without editing, renaming or converting it unnecessarily.

Check whether the export omits deleted items, reactions, read status, message IDs, headers, version history, permissions, linked devices or other relevant context.

Record any limitation stated by the provider or application.

A native export may be suitable where authenticity is not disputed, the source remains available, the material is limited and no deeper device examination is required.

It may be insufficient where the account is compromised, several users share access, content is disappearing, metadata is missing or the export process itself changes the account.

Do not assume a file is native merely because it came from the application. Screenshots, printouts and copied text are derivative records.

Where the evidential question is complex or likely to be challenged, seek specialist advice before relying on export alone.

Operational takeaway¶

Use a native export where it preserves the required content and metadata proportionately, but record its method, scope and omissions before deciding the original device is unnecessary.