Messaging, Social Media & Telecoms¶

126 investigator questions.

Use the list below or search the complete library.

• A message, chat or communications account may be relevant to my investigation — where do I start?
• What can a message actually prove?
• Does a message identify who wrote it?
• What exactly have I been given: a screenshot, export, notification or provider record?
• Does the sender name identify the sender?
• Does delivery prove the recipient received the message?
• Does a read receipt prove the recipient personally read it?
• What can a screenshot of a message prove?
• What are the main limitations of a messaging screenshot?
• What should be preserved alongside a messaging screenshot?
• Is a notification the same as the underlying message?
• What is a native chat export?
• Does a chat export contain the complete conversation?
• How should screenshots and exports be compared with device or provider records?
• What does “sent” mean on a messaging service?
• What does “delivered” mean on a messaging service?
• What does “read” or “seen” mean?
• What does “pending”, “failed” or “not delivered” mean?
• What does a message timestamp actually represent?
• Which time zone is being shown in a message record?
• Why might different systems show different times for the same message?
• Can a sent message be edited?
• What does an edited-message marker prove?
• Can the original wording of an edited message be recovered?
• What happens when a user deletes a message?
• Does “delete for everyone” remove every copy of a message?
• What are disappearing messages?
• What evidence may survive after a message has been edited, deleted or expired?
• What does membership of a group chat prove?
• Does group membership prove that a person saw every message?
• How can group membership change over time?
• What can a group administrator do?
• Can several people administer the same group or channel?
• What is the difference between a group, channel, broadcast list and community?
• What should be preserved about group membership, roles and permissions?
• Does a messaging username identify a person?
• What is the difference between a username and a display name?
• Can a messaging username or display name change?
• What is a service-specific account or user ID?
• Which messaging account identifiers should be preserved?
• Can one person operate several messaging accounts?
• How should a messaging account be linked to a device or person?
• Does a telephone number identify a person?
• What is the difference between the subscriber, account holder and user of a number?
• Can a telephone number be reassigned?
• Can several people use the same telephone number?
• Can one person use several telephone numbers?
• What is number porting and why can it matter to an investigation?
• What is a SIM swap and what might it explain?
• What is a virtual or VoIP telephone number?
• What is a temporary or disposable telephone number?
• What is a SIM and what does it identify?
• What are an IMSI and an ICCID?
• What is an IMEI and what does it identify?
• Can one SIM be used in several devices?
• Can one device use several SIMs or eSIMs?
• What can an SMS message actually prove?
• Does an SMS record prove who typed the message?
• What does an SMS delivery report prove?
• Can the apparent sender of an SMS be spoofed?
• What is an alphanumeric sender ID?
• What is an MMS and how does it differ from SMS?
• What is the difference between handset message content and network communications records?
• Is an internet messaging service device-based, account-based or both?
• What is end-to-end encryption?
• Does end-to-end encryption mean that no evidence exists?
• Who may still hold the content of an encrypted message?
• What messaging metadata may exist when the provider cannot read the content?
• Can a recipient provide message content that the provider cannot?
• What should investigators avoid overstating about encrypted messaging?
• What is a linked messaging device?
• Can one messaging account be active on several devices?
• Can a linked or web device send messages independently?
• What does a linked-device record prove?
• Can an attacker or unauthorised user add a linked device?
• Where might messaging backups be stored?
• Can synchronisation create different message states on different devices?
• What can a messaging attachment prove?
• Does receiving an attachment prove that it was opened?
• Can an attachment remain after the message containing it is deleted?
• What is a thumbnail or media preview?
• Could a thumbnail or preview have been generated automatically?
• What does a link preview prove?
• How can the same image, video or file appear in several chats?
• What can a messaging call record prove?
• Does a call record prove that the parties spoke?
• What is the difference between attempted, ringing, answered and completed calls?
• Can a communications call involve several devices or sessions?
• What should be preserved about a group voice or video call?
• Are messaging calls recorded by default?
• What can VoIP call records prove?
• What does a location shared in a message prove?
• What is the difference between a static location and live-location sharing?
• Could a shared location have been manually selected or manipulated?
• Does “online” or “active now” prove that the user was present?
• What does “last seen” prove?
• What is a direct message or platform inbox?
• What is a message request and why might it matter?
• What records might an internet messaging provider hold?
• What records might a telecommunications provider hold?
• What messaging records might an employer or organisation hold?
• What should be preserved before requesting provider records?
• What identifiers should be included in a messaging-provider request?
• Why should investigators request raw records rather than only a provider summary?
• Could messaging or telecoms provider records disappear quickly?
• What can messaging records prove about an account?
• What can messaging records prove about a device?
• What can messaging records prove about a person?
• What evidence may corroborate message authorship?
• Could a messaging account have been compromised?
• Could a message have been automated, scheduled or generated by an application?
• How should alternative explanations for messaging activity be assessed?
• Could opening a message alter the evidence?
• Could marking a message as read create a new record?
• Could opening a disappearing message destroy or change it?
• Could reconnecting a device trigger messaging synchronisation?
• Could changing account settings alert another user?
• What should be recorded before blocking, removing or revoking access?
• When should specialist support be sought before interacting with a messaging account or device?
• How should message evidence be described in an investigative report?
• How should delivery and read-status evidence be worded?
• How should messaging screenshots be presented evidentially?
• How should uncertainty about message authorship be reported?
• What are the most common mistakes in messaging investigations?
• When should a messaging line of enquiry stop?
• What is the overall investigator checklist for messaging, social-platform and telecoms evidence?