What can messaging records prove about a device?¶

Messaging records may link account activity to a phone, tablet, computer or browser session.

Evidential caution: that identifying the device identifies the person who acted.

What this means¶

Device-level evidence may include application data, linked-device records, session identifiers, local message databases, notifications, account tokens and provider device information.

These records can help show that a device stored, displayed, sent, received or synchronised messaging activity.

They may also show when an account was linked, when a device was last active or which device generated a particular event.

But a device can be shared, borrowed, stolen, unattended or remotely accessed.

A device record may also reflect synchronised account activity that originated elsewhere.

Be precise about whether the record identifies the device itself or only a device label supplied by the service.

In reports, distinguish “The message was present on this device” from “This device sent the message” and from “This person used the device.”

Where the issue is disputed, identify what additional evidence would strengthen or weaken the attribution.

What to check or do next¶

• Preserve device identifiers, session details, account links, timestamps, application data and the condition of the device when examined.
• Compare device evidence with linked-session records, location, unlock activity, possession, witnesses and surrounding communications.
• Preserve the source and collection method so another investigator can test the same conclusion.

Evidential limits¶

Possession at seizure does not prove control at the earlier time of the communication.