A message, chat or communications account may be relevant to my investigation — where do I start?¶

You have been given a message, chat, communications account or reference to an online conversation.

Evidential caution: that the visible message is the evidence. It may only be one representation of a wider set of records.

What this means¶

The first job is not to decide who sent it. The first job is to work out exactly what you have, where it came from and what may still exist elsewhere.

Think in three evidence locations.

The first is the device: message content, notifications, attachments, local databases and linked-session information.

The second is the organisation: workplace systems, collaboration platforms, moderation records, audit logs or managed-device records.

Then define the investigative question. Are you trying to prove that a message existed, that an account sent it, that a device was used, or that a particular person authored it? Each requires different corroboration.

What to check or do next¶

• Start by identifying the service. Is this SMS, WhatsApp, Signal, Telegram, Messenger, Instagram, Discord, Teams, Slack or something else? Then identify the form of the material. It could be a screenshot, a notification, a copied message, a chat export, a device artefact, an extraction report or a provider record. Those are not equivalent.
• Record who supplied it, how it was obtained and whether the original device, account or file is still available. Do not open, forward, delete, edit or synchronise material unnecessarily. On some services, opening a message can mark it as read, trigger disappearing content or change what another participant can see.
• Preserve stable identifiers early: telephone numbers, usernames, account IDs, group names, message IDs, dates, times and time zones. Also record what is missing.

Evidential limits¶

The third is the provider: account identifiers, registration information, session records, delivery events, group membership and other metadata. The provider may not hold readable content, particularly where end-to-end encryption is used.