I have been given messages or communication records
Preserve what was supplied and establish whether it is a screenshot, notification, export, device record or provider record before drawing conclusions about authorship, delivery or meaning.
Investigate now
Start with what needs doing now
Use this route when messages may change, disappear, synchronise or create new records through investigator interaction.
Start the investigationWork through message evidence
Move from the material supplied to preservation, participants, service records and careful authorship assessment.
Reference MSG-000Preserve contextWhat belongs alongside a screenshot?Retain the surrounding conversation, account identifiers, device context, times and original source.
Reference MSG-009Interaction riskCould opening the message alter evidence?Consider read states, receipts, disappearing content and synchronisation before interacting.
Reference MSG-112 Learn
Understand the evidence and the offender method
Use this route to understand what message evidence can establish and how a separate offender method creates records across services.
Foundation explanationWhat can a message actually show?
Separate displayed content and service events from personal authorship.
Reference MSG-001Separate offender exampleSee how Dodgy Dave uses communications servicesFollow a different offending method without implying continuity with the investigated case.
Reference MSG-126 Common questions
Go directly to the issue you need to resolve
Identify the materialWhat exactly have I been given?
Distinguish screenshots, exports, notifications and provider records.
Reference MSG-003SpeedCould provider records disappear quickly?Act while short-lived service and connection records remain available.
Reference MSG-104AuthorshipWhat may corroborate who wrote it?Look for independent account, device, language and contextual evidence.
Reference MSG-108Provider preservationWhat should be preserved before a request?Retain the identifiers and context needed to locate the right records.
Reference MSG-101Browse every Messaging, social media and telecoms guidance page
The complete reference library remains available when you need a narrower question.- A message, chat or communications account may be relevant to my investigation - where do I start?
- What can a message actually prove?
- Does a message identify who wrote it?
- What exactly have I been given: a screenshot, export, notification or provider record?
- Does the sender name identify the sender?
- Does delivery prove the recipient received the message?
- Does a read receipt prove the recipient personally read it?
- What can a screenshot of a message prove?
- What are the main limitations of a messaging screenshot?
- What should be preserved alongside a messaging screenshot?
- Is a notification the same as the underlying message?
- What is a native chat export?
- Does a chat export contain the complete conversation?
- How should screenshots and exports be compared with device or provider records?
- What does “sent” mean on a messaging service?
- What does “delivered” mean on a messaging service?
- What does “read” or “seen” mean?
- What does “pending”, “failed” or “not delivered” mean?
- What does a message timestamp actually represent?
- Which time zone is being shown in a message record?
- Why might different systems show different times for the same message?
- Can a sent message be edited?
- What does an edited-message marker prove?
- Can the original wording of an edited message be recovered?
- What happens when a user deletes a message?
- Does “delete for everyone” remove every copy of a message?
- What are disappearing messages?
- What evidence may survive after a message has been edited, deleted or expired?
- What does membership of a group chat prove?
- Does group membership prove that a person saw every message?
- How can group membership change over time?
- What can a group administrator do?
- Can several people administer the same group or channel?
- What is the difference between a group, channel, broadcast list and community?
- What should be preserved about group membership, roles and permissions?
- Does a messaging username identify a person?
- What is the difference between a username and a display name?
- Can a messaging username or display name change?
- What is a service-specific account or user ID?
- Which messaging account identifiers should be preserved?
- Can one person operate several messaging accounts?
- How should a messaging account be linked to a device or person?
- Does a telephone number identify a person?
- What is the difference between the subscriber, account holder and user of a number?
- Can a telephone number be reassigned?
- Can several people use the same telephone number?
- Can one person use several telephone numbers?
- What is number porting and why can it matter to an investigation?
- What is a SIM swap and what might it explain?
- What is a virtual or VoIP telephone number?
- What is a temporary or disposable telephone number?
- What is a SIM and what does it identify?
- What are an IMSI and an ICCID?
- What is an IMEI and what does it identify?
- Can one SIM be used in several devices?
- Can one device use several SIMs or eSIMs?
- What can an SMS message actually prove?
- Does an SMS record prove who typed the message?
- What does an SMS delivery report prove?
- Can the apparent sender of an SMS be spoofed?
- What is an alphanumeric sender ID?
- What is an MMS and how does it differ from SMS?
- What is the difference between handset message content and network communications records?
- Is an internet messaging service device-based, account-based or both?
- What is end-to-end encryption?
- Does end-to-end encryption mean that no evidence exists?
- Who may still hold the content of an encrypted message?
- What messaging metadata may exist when the provider cannot read the content?
- Can a recipient provide message content that the provider cannot?
- What should investigators avoid overstating about encrypted messaging?
- What is a linked messaging device?
- Can one messaging account be active on several devices?
- Can a linked or web device send messages independently?
- What does a linked-device record prove?
- Can an attacker or unauthorised user add a linked device?
- Where might messaging backups be stored?
- Can synchronisation create different message states on different devices?
- What can a messaging attachment prove?
- Does receiving an attachment prove that it was opened?
- Can an attachment remain after the message containing it is deleted?
- What is a thumbnail or media preview?
- Could a thumbnail or preview have been generated automatically?
- What does a link preview prove?
- How can the same image, video or file appear in several chats?
- What can a messaging call record prove?
- Does a call record prove that the parties spoke?
- What is the difference between attempted, ringing, answered and completed calls?
- Can a communications call involve several devices or sessions?
- What should be preserved about a group voice or video call?
- Are messaging calls recorded by default?
- What can VoIP call records prove?
- What does a location shared in a message prove?
- What is the difference between a static location and live-location sharing?
- Could a shared location have been manually selected or manipulated?
- Does “online” or “active now” prove that the user was present?
- What does “last seen” prove?
- What is a direct message or platform inbox?
- What is a message request and why might it matter?
- What records might an internet messaging provider hold?
- What records might a telecommunications provider hold?
- What messaging records might an employer or organisation hold?
- What should be preserved before requesting provider records?
- What identifiers should be included in a messaging-provider request?
- Why should investigators request raw records rather than only a provider summary?
- Could messaging or telecoms provider records disappear quickly?
- What can messaging records prove about an account?
- What can messaging records prove about a device?
- What can messaging records prove about a person?
- What evidence may corroborate message authorship?
- Could a messaging account have been compromised?
- Could a message have been automated, scheduled or generated by an application?
- How should alternative explanations for messaging activity be assessed?
- Could opening a message alter the evidence?
- Could marking a message as read create a new record?
- Could opening a disappearing message destroy or change it?
- Could reconnecting a device trigger messaging synchronisation?
- Could changing account settings alert another user?
- What should be recorded before blocking, removing or revoking access?
- When should specialist support be sought before interacting with a messaging account or device?
- How should message evidence be described in an investigative report?
- How should delivery and read-status evidence be worded?
- How should messaging screenshots be presented evidentially?
- How should uncertainty about message authorship be reported?
- What are the most common mistakes in messaging investigations?
- When should a messaging line of enquiry stop?
- What is the overall investigator checklist for messaging, social-platform and telecoms evidence?
- See how Dodgy Dave uses communications services
