What does “last seen” prove?¶

A profile may display a time described as last seen or last active.

Evidential caution: that this identifies the exact moment the person stopped using the service.

What this means¶

A last-seen value usually reflects the most recent account, device or session activity recognised by the platform.

The precise event may vary. It could relate to opening the application, maintaining a connection, sending a message or synchronising from a linked device.

The value may be rounded, delayed, hidden or affected by privacy settings.

A linked computer or tablet may update the status while the primary phone is elsewhere.

The account may also be shared or compromised.

Be alert to relative labels such as “recently”, “today” or “within a week”. These may represent broad categories rather than exact timestamps.

Where the issue is disputed, compare account, device, provider and surrounding contextual records before drawing a conclusion.

What to check or do next¶

• Preserve the displayed value, observation time, platform, account identifiers and any linked-device information.
• Compare the status with message events, login records, device data and witness evidence.
• Do not use a last-seen indicator to prove that the person viewed a specific message or was at a particular location.
• Preserve the original source and collection method so another investigator can test the same interpretation.

Evidential limits¶

In reports, explain that the platform displayed a last-active value and preserve any uncertainty about what generated it.