How should screenshots and exports be compared with device or provider records?¶

You may have several records of the same communication: screenshots, a chat export, device data and a provider return.

Evidential caution: that one must be correct and the others wrong if they do not match exactly.

What this means¶

Each source records a different part of the event.

Then compare content and status. Is the wording identical? Are messages absent from one source? Does one show an edit or deletion marker? Are attachments represented differently? Does the provider record confirm an event at a compatible time?

Account for time zones and system clocks before treating time differences as contradictions. One source may use UTC, another local time and another relative labels.

What to check or do next¶

• Start by aligning stable features: account IDs, telephone numbers, usernames, message IDs, group identifiers, dates and sequence. Do not rely only on display names.
• Use the strongest source for each conclusion. Content may come from the device or recipient. Account and session information may come from the provider. Provenance may depend on the person who captured or exported the material.

Evidential limits¶

A screenshot shows what appeared on a screen at capture time. An export shows what the application made exportable to that account. Device evidence may contain local databases, notifications, attachments, thumbnails and linked-session information. Provider records may show account identifiers, transmission events, sessions or group activity, but may not contain readable content.

Differences may have legitimate explanations. A screenshot may pre-date an edit. A notification may preserve deleted wording. An export may omit system events. One linked device may not yet have synchronised.

Record discrepancies rather than smoothing them away. The differences may reveal deletion, delayed delivery, account sharing, synchronisation or limitations in the collection method.