What should be preserved before requesting provider records?¶

A provider request may fail or return the wrong account if the identifiers are incomplete.

Evidential caution: that a username, display name or telephone number alone will always be enough.

What this means¶

This may include the service name, account ID, user ID, username, telephone number, email address, profile URL, conversation ID, group or channel ID, message ID, call ID, device ID and session ID.

Consider immediate preservation where records may be volatile or deletion is suspected.

Where the provider’s terminology is unclear, seek specialist advice before finalising the request.

Where the scope is disputed, record why each requested field is relevant to the investigative question.

What to check or do next¶

• Preserve every available stable identifier before making the request.
• Record the relevant time range, time zone and event type.
• Capture the identifiers in context through screenshots, exports, device records or original messages. Do not rely only on handwritten notes.
• Preserve profile changes, number reassignment, username changes, porting and linked-device information where relevant.
• If the evidence comes from a recipient or witness device, record that source and the account through which the material was viewed.
• Do not alter the live account unnecessarily before recording its current state. Logging in, changing passwords or removing sessions may create new events or destroy useful context.
• Preserve the source and collection method so another investigator can test the same interpretation.
• Preserve the source and collection method so another investigator can test the same interpretation.