Should a witness forward messages or files to the investigator?¶

Not automatically. Forwarding creates a new communication and may omit metadata, headers, filenames, account identifiers, timestamps or surrounding conversation from the original.

A forwarded item is a derivative¶

The action can change read status, create notifications and expose material through an unsuitable channel. Email forwarding may preserve less than an original message file or provider export; messaging screenshots may show appearance but not message IDs or full account data. A receiving platform can rename, convert or recompress attachments.

First document the original service, accounts, message state, date, time, attachments and conversation context. Do not ask the witness to download an unopened attachment, activate disappearing content or follow a link simply to make transfer easier.

Choose and document the transfer method¶

Where an urgent copy is justified, use an approved route and record who created it, how and when it was transmitted, and any cropping, added text, renamed file or format conversion. Preserve the received copy separately and label it as a derivative.

Confirm whether the source remains available and what state changed after transfer. A forwarded copy may assist immediate assessment, but it cannot by itself prove the original account, sender or timestamp without corroboration.