When should a messaging line of enquiry stop?¶

Messaging enquiries can expand quickly across devices, accounts, providers and participants.

Evidential caution: that every possible message record must be pursued regardless of value, cost or intrusion.

What this means¶

Also consider time, legal powers, privacy impact, safeguarding and provider retention.

Document why a line was pursued, narrowed or closed.

Equally, do not pursue broad provider or device searches without a defined purpose.

A proportionate stopping point is part of a defensible investigation, not a failure to exhaust every theoretical possibility.

What to check or do next¶

• Start with the investigative question. What fact are you trying to establish?
• Identify what evidence already exists and what additional record could materially change the assessment.
• Do not stop merely because encryption, deletion or account complexity makes the enquiry difficult. Other endpoints, recipient copies, metadata, backups or organisational records may still answer the question.
• Preserve the source and collection method so another investigator can test the same conclusion.
• Preserve the source and collection method so another investigator can test the same conclusion.

Evidential limits¶

Continue where the likely record is relevant, obtainable, proportionate and capable of resolving a real uncertainty.

Stop where the remaining enquiry would only duplicate established evidence, has little prospect of recovery, or cannot materially affect the decision.

Where uncertainty remains, identify what further evidence would be needed and why it would matter.

Where uncertainty remains, identify what further evidence would be needed and why it would matter.