What does a link preview prove?¶

A message containing a web address may display a title, image and description.

Evidential caution: that the preview proves the sender or recipient opened the link.

What this means¶

A link preview is usually generated when the application, device or provider retrieves information about the web page.

That process may occur automatically when the message is composed, sent, received or displayed.

The preview can help identify the destination that the link represented at that time. It may preserve a title, image or description even if the page later changes or disappears.

It may have been generated by the sender’s device, the recipient’s application, a provider-controlled service or another automated process.

Where lawful and safe, preserve the current destination separately. Do not click potentially harmful or operationally sensitive links from an evidential device without a plan.

Be alert to redirects. The displayed link text, preview destination and final website may differ.

In reports, distinguish “the message generated or displayed a preview of this page” from “the user visited the page.”

What to check or do next¶

• Preserve the original message, full URL, shortened-link form, preview content, message ID, timestamp and account details.
• Check browser history, DNS or network records, application logs and device artefacts for evidence of actual access.
• Preserve the source and collection method so another investigator can test the same conclusion.

Evidential limits¶

But the preview does not automatically prove that a person visited the website.