What is the overall investigator checklist for messaging, social-platform and telecoms evidence?¶

When messaging evidence first appears, investigators need a disciplined sequence rather than immediate interpretation.

Evidential caution: that the visible message tells the whole story.

What this means¶

First, identify the service, account, number, device, conversation and relevant time period.

Second, preserve the current state. Record connectivity, notifications, unread status, disappearing content, linked devices, group membership, roles and visible identifiers before interaction.

Third, preserve stable IDs: account, user, message, conversation, group, channel, call, SIM, device and session identifiers.

Fourth, separate the evidential questions.

What did the account do?

Which device or session was involved?

Who controlled it at the relevant time?

Fifth, preserve the content and context: surrounding messages, attachments, edits, deletions, delivery states, calls, locations and group changes.

Sixth, identify other sources: recipient devices, linked devices, providers, telecommunications records, employers, backups and cloud or organisational systems.

Eighth, seek specialist support before actions that may consume, synchronise, delete, alert or materially alter the evidence.

Finally, report precisely. Distinguish account activity, device activity, personal attribution, delivery, awareness and participation.

What to check or do next¶

• Preserve the source and collection method so another investigator can test the same conclusion.
• Preserve the source and collection method so another investigator can test the same conclusion.

Evidential limits¶

Seventh, test alternative explanations such as shared use, compromise, number reassignment, automation, forwarding and synchronisation.

Where uncertainty remains, identify what further evidence would be needed and why it would matter.