What is the difference between handset message content and network communications records?¶

An investigation may obtain messages from a handset and records from a communications provider.

Evidential caution: that both sources contain the same information and prove the same thing.

What this means¶

Handset content may show the actual text, images, attachments, contact names, message order and local status presented to the user.

Network communications records may show that a communication event occurred between services or subscriptions, with times, routing, delivery or device information.

Contact names on the device may be locally assigned and do not identify the subscriber. Provider records may identify the subscription but not the person who used the handset.

Times may also differ. The handset may use local display time, while the provider records network events in another time basis.

Where records differ, consider time zones, delivery stages, deletion, synchronisation and collection method.

In reports, state whether a conclusion comes from the handset, the provider or both.

What to check or do next¶

• Use the sources together. Handset evidence may establish content. Provider records may corroborate transmission, subscription, device association or timing.
• Preserve the original records and document the source of every conclusion. Do not merge handset content and provider data into a single unexplained narrative.
• Preserve the source and collection method so another investigator can test the same interpretation.

Evidential limits¶

The provider may not retain the readable content. The handset may not retain the full network event history.