Does receiving an attachment prove that it was opened?¶

A device may contain an attachment delivered through a messaging service.

Evidential caution: that receipt proves the user opened or viewed the file.

What this means¶

Messaging applications may download attachments automatically, partially download them, cache them or create previews in the background.

The file may therefore exist on the device without deliberate user action.

A thumbnail or preview can also be generated automatically. Its presence may show that the application processed the attachment, not that a person examined it.

Evidence of opening may include application logs, access times, viewer history, full-size rendering, exported copies, forwarding, saving to another location or later references to the content.

But access times can be altered by synchronisation, backup, extraction or system processes. They should not be interpreted in isolation.

In reports, distinguish “the attachment was delivered to the account or device” from “the user opened and viewed the attachment.”

What to check or do next¶

• Preserve the original message, attachment, download status, local file path, thumbnail, metadata and surrounding account activity.
• Record whether automatic download was enabled and whether the device was online at the relevant time.
• Look for user actions consistent with viewing: replies discussing the content, edits, sharing, screenshots, saved copies or movement into another application.
• Do not treat a delivered or downloaded file as proof of awareness.
• Preserve the source and collection method so another investigator can test the same conclusion.