Who may still hold the content of an encrypted message?¶

A provider may be unable to supply the readable content of an encrypted conversation.

Evidential caution: that this means nobody can hold the message.

What this means¶

The sender’s device may contain the content. So may the recipient’s device.

Linked phones, tablets, desktop applications and browser sessions may hold synchronised copies.

Notifications may preserve previews. Screenshots, quoted replies, forwarded messages and chat exports may also retain all or part of the content.

Attachments may survive separately in downloads, galleries, shared folders, backups or other chats.

A workplace or regulated organisation may retain communications through compliance, archiving or device-management systems, depending on how the service is configured.

Where several copies exist, compare message IDs, sequence, timestamps and account identifiers rather than relying only on appearance.

A copy held by one participant can establish content, but authorship and personal control still require separate evidence.

Where records differ, retain the discrepancy and establish whether it reflects timing, synchronisation or collection method.

What to check or do next¶

• Preserve all likely copies before changing passwords, removing devices or reconnecting offline systems.
• Ask participants what devices they used and whether they exported, forwarded, saved or backed up the conversation.
• Preserve the source and collection method so the conclusion can be reviewed and reproduced.

Evidential limits¶

Cloud backups may contain message data, but their content and encryption arrangements vary. Do not assume that every backup is readable or complete.