What can messaging records prove about a person?¶

Messaging records may strongly suggest that a person controlled an account or device.

Evidential caution: that an account name, telephone number or seized handset is enough to identify the human author.

What this means¶

Personal attribution requires a chain of evidence.

First establish the account involved.

Then identify the device or session used.

Then establish who controlled that device or session at the relevant time.

Useful evidence may include possession, passcode knowledge, biometric use, location, witness accounts, distinctive knowledge in the messages, surrounding conduct, admissions, login history and repeated patterns of access.

No single factor should automatically be treated as conclusive.

A subscriber record identifies the registered customer. A device found in a home identifies where it was recovered. A username identifies an account label. Each is useful, but none necessarily proves personal use.

Consider sharing, delegation, compromise, remote access and automation.

Build a timeline that connects the person to the device and account during the specific event, not merely before or after it.

Avoid wording that converts technical association into personal certainty.

Where the issue is disputed, identify what additional evidence would strengthen or weaken the attribution.

What to check or do next¶

• Preserve the source and collection method so another investigator can test the same conclusion.
• Preserve the source and collection method so another investigator can test the same conclusion.

Evidential limits¶

In reports, explain the evidential steps and preserve any realistic alternative explanation.