What messaging records might an employer or organisation hold?¶

A workplace messaging account may be part of a wider organisational system.

Evidential caution: that the user’s device or provider is the only source of records.

What this means¶

An employer or organisation may hold account directories, user assignments, group membership, administrative roles, retention policies, audit logs, login events and device-management records.

It may also hold messages, files, meeting chats, call records, channel history, compliance archives or backups.

The organisation may be able to identify who was assigned an account, which devices were managed and when permissions changed.

In reports, distinguish account assignment from actual use and administrative access.

What to check or do next¶

• Preserve the organisation’s platform, tenant or workspace identifier, account ID, username, employment role, relevant dates and device assignments.
• Ask for raw audit and message records with field definitions where available.
• Record the organisation’s retention, deletion and legal-hold settings. These may explain why some records exist and others do not.
• Do not rely solely on screenshots supplied by a manager or colleague. Seek original exports or system records where proportionate.
• Compare organisational records with local device evidence, provider data and witness accounts.
• Preserve the source and collection method so another investigator can test the same interpretation.

Evidential limits¶

But an assigned account does not automatically identify the person who used it at every moment. Shared terminals, delegated access, compromised accounts and administrator actions must still be considered.