Does a message identify who wrote it?¶

You may have a message that appears to come from a named person, telephone number or familiar account.

Evidential caution: that the apparent sender is automatically the human author.

What this means¶

A message record normally identifies the account, number, device or service identity through which the message was sent. That is useful, but it is not the same as identifying the person who typed, dictated, selected or caused the message to be sent.

Several explanations may need to be considered.

The account may be shared. Another person may have used an unlocked device. A linked laptop or web session may have been active. The account may have been compromised. A workplace account may have been accessed by a colleague or delegate. A message may have been scheduled, sent by a bot or generated by an application.

The wording of the message may provide clues. Personal knowledge, language style, timing, references to events and responses from others may support authorship. But style alone is rarely conclusive and should not be treated as a substitute for technical or contextual evidence.

Also consider whether the message was original. It may have been forwarded, copied, pasted, quoted or sent from a compromised conversation.

Report the conclusion carefully. It may be justified to say that a message was sent from a particular account or associated with a particular device. Saying that a named person authored it requires a stronger evidential basis.

What to check or do next¶

• Look for corroboration around the event. Relevant material may include device-use evidence, account login records, linked-device records, biometric or passcode use, nearby activity, photographs, location information, contemporaneous conduct and admissions.

Evidential limits¶

Even possession of the device at a later date does not prove who used it at the relevant time.