Skip to content
Skip to main content
First Response & Preservation Technical Explainer

Could leaving or removing someone from a group alter the evidence?

Yes. Membership changes can create system messages and alerts, alter roles and remove access to current or future content.

Preserve the group structure

Record platform, name, description, participant list, administrators, invitation details, visible messages, timestamps and linked channels. Note whether the group is private, encrypted or moderated.

Do not leave to silence notifications or remove a suspicious participant without assessing what access and observation may be lost.

Protect people proportionately

If continuing harm requires removal, record risk, alternatives, authority, operator, time and every visible result. The change may affect shared files, calls and admin rights.

Former participants may retain earlier copies even when current access ends, so do not overstate containment.

Key takeaway

Preserve membership, roles and content context before a group change modifies both access and the evidence of participation.

Reference: FRP-115First Response & Preservation