Could opening a message alter the evidence?¶

A message may be visible in a notification, unread list or message request before an investigator opens it.

Evidential caution: that simply opening the message is a neutral act.

What this means¶

Opening a message can create a read or seen event, update the conversation state, download media, generate previews, trigger synchronisation or notify another participant.

It may also move the message from a request folder into the main conversation or change its local status.

Where disappearing or one-time content is involved, opening may start a timer, consume the content or prevent later access.

Consider whether the device is online and whether linked devices may synchronise the change.

Where the consequences are unclear, seek specialist support before interacting.

In reports, distinguish the pre-interaction state from evidence created by the investigative action.

Where the consequence is uncertain, record the risk and the reason for any decision to proceed.

What to check or do next¶

• Preserve the current state before interaction. Record the device, account, application, time, connectivity, notification, unread indicator and visible preview.
• Capture screenshots or photographs where lawful and proportionate, but do not rely on them as the only record.
• Do not open suspicious links, attachments or media merely to see what they contain. That may create security, evidential or operational risk.
• If opening is necessary, document who authorised it, what steps were taken and every change observed.
• Preserve the source and collection method so another investigator can test the same interpretation.