What can a messaging attachment prove?¶

A messaging conversation may contain an image, video, audio file, document or other attachment.

Evidential caution: that the attachment proves who created it, who opened it and why it was sent.

What this means¶

An attachment can help show that a file was associated with a particular message, account, conversation or device at a recorded time.

It may preserve the file itself, a thumbnail, filename, size, message reference or download status.

That can be important evidence of distribution, possession, communication or context.

The apparent filename may be changed. Metadata may be missing, altered or stripped by the messaging service.

Where attribution is important, look for creation evidence, earlier copies, device history, cloud storage, editing traces and surrounding communications.

What to check or do next¶

• Preserve the original file where available, not just a screenshot or preview. Record the message, sender, recipient, conversation, message ID, attachment ID, filename, size, timestamp and download state.
• Compare the attachment across sender and recipient devices, exports, backups and other chats. Matching hashes or technical characteristics may help establish that files are the same, but context still matters.

Evidential limits¶

But the attachment alone may not identify its original creator. It may have been forwarded, copied, downloaded from elsewhere, generated automatically or received from another source.

Receiving the attachment does not prove that it was opened, viewed or understood. A device may download content automatically or generate a preview without deliberate user action.