Where might messaging backups be stored?¶

A live conversation may be incomplete, deleted or unavailable, while a backup still exists elsewhere.

Evidential caution: that messaging data exists only inside the application on the phone.

What this means¶

Backups may be stored locally on the device, on removable storage, in a computer backup or in a cloud account.

Some services create their own backups. Others rely on the device operating system or wider account backup.

Encryption arrangements vary. A backup may be protected differently from the live message service, or it may be inaccessible without account credentials or device keys.

Where several backups exist, compare them chronologically.

In reports, distinguish material recovered from a backup from material observed in the current application.

Where the position is unclear, compare device records, provider metadata and the account’s security history.

What to check or do next¶

• Preserve the device, cloud-account details, backup settings, dates, storage locations and recovery information.
• Do not restore a backup casually. Restoration may overwrite current data, alter timestamps or synchronise changes across devices.
• Look for old phones, computers, external drives and cloud-storage accounts associated with the user.
• Record the backup date and scope. A backup may show an earlier conversation state and should not be presented as the live state at a later time.
• Preserve the original source and collection method so another investigator can test the same conclusion.

Evidential limits¶

A backup may contain message databases, attachments, settings and account information, but it may not be current or complete.