Could opening a disappearing message destroy or change it?¶

A message may be configured to disappear after opening, after a timer or after a limited number of views.

Evidential caution: that opening the content will allow it to be examined again later.

What this means¶

Some disappearing messages start an expiry timer when opened. Others can be viewed only once or removed after the recipient leaves the screen.

Opening may therefore consume the evidence, alter the message state or notify the sender.

The content may also trigger automatic download, screenshot warnings or linked-device synchronisation.

Where lawful and proportionate, consider specialist capture methods, recipient-side preservation, linked-device evidence, notifications, backups or provider metadata.

The behaviour may depend on application version, settings and whether the device is online.

In reports, explain whether the content was preserved before expiry, observed once or reconstructed from other sources.

Where the consequence is uncertain, record the risk and the reason for any decision to proceed.

What to check or do next¶

• Preserve the unopened state, message details, timer, sender, recipient, account IDs, visible preview and notification before taking action.
• Do not test the feature on the evidential message.
• If operational necessity requires opening, prepare the recording method first and document the entire process.
• Preserve the source and collection method so another investigator can test the same interpretation.

Evidential limits¶

Do not assume that disappearing content leaves no trace. Message references, notifications, thumbnails, attachments and other participants’ copies may remain.