What evidence may corroborate message authorship?¶

An account may be identified as the sender, but authorship may still be disputed.

Evidential caution: that the sender field alone proves who composed the message.

What this means¶

Corroboration may come from device possession, unlock activity, biometric use, location, witness evidence, contemporaneous photographs, account logins and linked-device records.

The content itself may also help. Personal knowledge, references to recent events, known relationships, distinctive vocabulary or immediate follow-up conduct can support attribution.

Drafts, typing artefacts, clipboard activity, voice-input history, saved attachments or earlier versions may show how the message was prepared.

Replies from others may confirm how the sender was understood, but they do not independently prove authorship.

The strongest attribution usually comes from several independent strands pointing in the same direction.

In reports, identify each supporting factor and explain its limitation.

Where the issue is disputed, identify what additional evidence would strengthen or weaken the attribution.

What to check or do next¶

• Preserve the full conversation, surrounding messages, device and account records, not just the disputed message in isolation.
• Preserve the source and collection method so another investigator can test the same conclusion.
• Preserve the source and collection method so another investigator can test the same conclusion.

Evidential limits¶

Linguistic style can be relevant, especially across a sustained body of messages, but should not be treated as decisive on its own.

Consider alternative explanations: shared accounts, copied text, impersonation, scheduled messages, automation and compromise.