Could opening a message alter the evidence?¶
Yes. Access can change read state, conversation order and account history, load remote content, synchronise data and reveal activity to another user.
Preserve the unopened context¶
Record preview, sender, account, conversation, time, unread status, attachments and device. Note disappearing, edited, encrypted or pending indicators.
Remote images and tracking can expose a connection when loaded. Even without visible change, the provider may create an access event.
Open only for a defined reason¶
If safeguarding or threat assessment justifies access, record why, who opened it and every receipt, timestamp, alert or content change.
Where already open, preserve visible content and conversation without unnecessary scrolling. A preview is incomplete but remains part of the original state.
Key takeaway
Treat message opening as an active account event and preserve its unread presentation before any justified access.
