What does a message timestamp actually represent?¶

A message may display a single time beside it, but that time can represent different events.

Evidential caution: that the visible timestamp always shows exactly when the sender wrote or sent the message.

What this means¶

Depending on the service and record type, the time may relate to message creation, upload, provider acceptance, delivery, display, read status, export generation or local database storage.

A screenshot usually shows the application’s presentation of time. An export may convert times into the device’s local time zone. A provider return may use UTC. A forensic extraction may expose stored values that differ from what the user saw.

Offline behaviour can add further complexity. A message may be composed while the device is offline, transmitted later and displayed with either the original creation time or the later sending time.

What to check or do next¶

• Preserve the source of every timestamp. Record whether it came from a screenshot, export, device artefact, provider return or witness account. Note the time zone, device clock settings and whether daylight-saving changes apply.
• Compare sequence as well as absolute time. The order of messages, replies, calls and surrounding activity may be reliable even where the precise displayed time needs adjustment.
• Do not silently convert all records into one time basis. Keep the original values, document any conversion and explain the method.

Evidential limits¶

Edited, forwarded or restored messages may also carry several relevant times. The visible time may not show when the underlying content was first created.

When reporting, say what event the timestamp appears to represent. If that cannot be established, describe it as the time displayed by the source rather than as a definitive sending time.