What can messaging records prove about an account?¶

Messaging records can often establish that a particular account was involved in a communication.

Evidential caution: that proving the account proves the person.

What this means¶

Account-level evidence may include service-specific user IDs, usernames, registered numbers, email addresses, profile details, conversation membership, message events, call events and linked-device records.

These records can help show that the account sent, received, displayed or interacted with communications at particular times.

They may also show account creation, security changes, linked sessions, group roles or provider-held activity.

But the account may be shared, delegated, compromised or active on several devices.

A registered telephone number or email address may identify how the account was created without identifying who used it during the relevant event.

Separate what came from the device, the provider, a recipient or an organisational system.

In reports, “The account sent the message” may be justified where the service records support it. “This person sent the message” requires an additional attribution step.

Where the issue is disputed, identify what additional evidence would strengthen or weaken the attribution.

What to check or do next¶

• Preserve stable account IDs, historical usernames, registered contact details, session records, device links and timestamps.
• Where possible, identify the specific message ID, conversation ID and event associated with the account.
• Do not merge account association with authorship or personal responsibility.
• Preserve the source and collection method so another investigator can test the same conclusion.