What identifiers should be included in a messaging-provider request?¶

A provider request may name the service but still be too vague to identify the correct account or records.

Evidential caution: that the provider can reliably search from a display name or screenshot alone.

What this means¶

Include every reliable identifier available.

This may include the account or user ID, username, registered telephone number, email address, profile URL and relevant historical identifiers.

For conversations, include conversation IDs, group IDs, channel IDs, participant IDs, message IDs, call IDs and attachment references where available.

Include the precise date range, time zone and event types required.

Explain whether the request concerns registration, subscriber information, linked devices, sessions, security events, group membership, message metadata, calls, content or account changes.

Where a username may have changed, provide both the historical and current values and any stable account ID linking them.

Avoid requesting unrelated material merely because it may exist. A precise request is more defensible and easier for the provider to interpret.

Where the scope is disputed, record why each requested field is relevant to the investigative question.

What to check or do next¶

• Preserve the original format of identifiers. Do not remove prefixes, leading zeros, punctuation or international country codes without recording the original.
• Ask for field definitions, time basis and original records where possible.
• Preserve the source and collection method so another investigator can test the same interpretation.
• Preserve the source and collection method so another investigator can test the same interpretation.