What does an edited-message marker prove?¶

A messaging service may place “edited” or a similar label beside a message.

Evidential caution: that the marker proves exactly what was changed and why.

What this means¶

An edited-message marker normally shows that the service recorded a modification after the message was first sent or created. That can be important evidence because it establishes that the visible wording is not necessarily the original wording.

What to check or do next¶

• Preserve the message as displayed, the marker, the conversation context and all associated times. Capture the account identifiers and any linked-device information available.
• Look for references to the earlier wording. A reply may quote it. Another participant may describe it. A notification may preserve a preview generated before the edit.
• Do not infer a dishonest purpose merely from the fact of editing. Users edit messages for many reasons, including correcting spelling or clarifying meaning. Intent requires contextual evidence.

Evidential limits¶

But the marker may not identify the original content. It may not show whether one character, an entire sentence or a link was changed. It may not display the number of edits or the exact time of each one.

The marker also does not identify the human editor. The account may have been used from a linked device, shared with another person or compromised.

Some services preserve edit history; others display only the latest version. A device notification, reply quotation, screenshot or another participant’s device may retain an earlier version even where the main conversation does not.

In reports, say what the marker establishes and what it does not. “The application showed the message as edited” is defensible. “The suspect removed the threat” requires evidence of both the earlier wording and the editor.