What exactly have I been given: a screenshot, export, notification or provider record?¶

Before interpreting a message, identify the form of the evidence you have received.

Evidential caution: that every copy of a conversation has the same evidential value.

What this means¶

A screenshot records what appeared on a screen at the moment it was captured. It may preserve useful content, names, times and message states. But it may omit earlier or later messages, hide account identifiers, reflect renamed contacts and lose technical metadata.

A notification is different. It is a device-generated preview or alert. It may show only part of the message, may be produced automatically and may remain after the underlying message has changed or disappeared. A notification is not necessarily the complete communication.

A native export is created by the service or application using an export function. It may preserve a longer conversation and more structured information than screenshots. However, exports vary. They may exclude deleted content, reactions, edits, calls, attachments, system events or precise identifiers.

A device artefact is material recovered from the device or application storage. It may include databases, cached media, thumbnails, logs and deleted remnants. Its interpretation may require specialist support.

What to check or do next¶

• Record the evidence type accurately. Preserve the original file, capture method, source, date obtained and any accompanying metadata. Where possible, compare the representation with the original device, account or provider records.

Evidential limits¶

A provider record comes from the communications service or telecommunications provider. It may contain account, session, delivery, subscriber or group information. It may not contain readable message content, particularly where end-to-end encryption is used.

An extraction report is another representation. It is produced by forensic software from acquired device data. It should be read alongside its source, method and limitations rather than treated as the device itself.