What can a message actually prove?¶

A message can be highly relevant evidence, but its meaning depends on what has actually been preserved and where the record came from.

Evidential caution: that a message automatically proves who wrote it, who read it and what happened as a result.

What this means¶

At its strongest, a message may help show that particular content was associated with an account, device or communications service at a recorded time. It may show the apparent sender and recipient, the text or media exchanged, message status, group context and sometimes a service-specific message identifier.

That can support important conclusions. It may establish that a threat was communicated, that instructions were sent, that information was shared or that accounts interacted.

An account may be shared, compromised or accessed through a linked device. A person other than the account holder may have physical access to the phone. A message may have been scheduled, automated, generated by an application or forwarded from elsewhere.

Message status needs similar care. “Sent” may mean accepted by the sender’s application. “Delivered” may mean delivered to an account or device. “Read” may mean that the service generated a read event. None of those states necessarily proves personal attention, comprehension or agreement.

Assess the source of the record. A device artefact, native export, provider return and screenshot may each establish different things. Compare them where possible.

Then seek corroboration: account records, device possession, linked sessions, login activity, surrounding conversation, witness evidence, location information, attachments and other conduct consistent with authorship.

Evidential limits¶

But the message alone usually does not identify the human author.

The visible content may also lack provenance. A screenshot may accurately show what appeared on a screen, but it may not establish whether the conversation is complete, whether names were changed, whether messages were deleted or whether the image was altered.