Is a notification the same as the underlying message?¶

A device notification may display the sender, part of a message and a time.

Evidential caution: that the notification is a complete copy of the underlying message.

What this means¶

A notification is an alert created by the device or application. It may contain a preview of message content, but that preview can be shortened, reformatted or generated from information available when the alert was created.

Notifications can also outlive the message. A preview may remain in notification history after the sender edits, deletes or unsends the underlying content. That can make notifications valuable, but it also means the notification and current conversation may show different states.

The sender name may come from the device’s contacts or from the application. It should not be treated automatically as verified identity.

A notification time may represent when the device generated or received the alert rather than when the sender created the message. Delayed network delivery, offline devices and synchronisation can produce differences.

Then compare the alert with the native message, device artefacts, recipient records or provider information. If the underlying message is missing, describe the evidence accurately as a notification record rather than as the complete message.

Notifications can corroborate that content reached or was presented to a device. They do not automatically prove the full content, personal receipt or authorship.

What to check or do next¶

• Preserve the notification carefully. Record the device, application, visible wording, time and whether the underlying conversation was opened. Avoid clearing notifications unnecessarily.

Evidential limits¶

The underlying message may contain more text, an attachment, a reply reference, an edit marker or other context that the notification does not show. A notification may display only the first message where several arrived together.