Can a recipient provide message content that the provider cannot?¶

A provider may be unable to supply encrypted message content, while the recipient can still see the conversation.

Evidential caution: that the provider is the only authoritative source of the message.

What this means¶

The recipient may provide screenshots, a native export, the original device or a forensic extraction.

Each form has different evidential value. A screenshot shows what appeared on the screen. An export may preserve more sequence. Device evidence may retain content, attachments, notifications and account identifiers.

Also consider whether the recipient controlled the account throughout. A linked device or shared account may complicate attribution.

In reports, explain that the content came from the recipient endpoint rather than from the provider.

Where records differ, retain the discrepancy and establish whether it reflects timing, synchronisation or collection method.

What to check or do next¶

• Preserve the recipient’s account and device context. Record how the material was obtained, who supplied it and whether the original conversation remains available.
• Check stable identifiers, timestamps, message IDs, reply chains and surrounding context.
• Where possible, compare the recipient’s record with sender-side evidence, provider metadata and other participants’ copies.
• Preserve the source and collection method so the conclusion can be reviewed and reproduced.

Evidential limits¶

End-to-end encryption is designed so that the endpoints can read the content. The recipient’s device may therefore hold the same message the provider cannot read.

Do not assume the recipient’s copy is complete. Messages may have been deleted, edited, expired or omitted from an export.