What can a message actually show?¶

A message can record words, images or other content exchanged through a communications service. It may strongly establish what was communicated and when, while leaving the identity of the human author as a separate question.

The same message can appear in several forms¶

A recipient may supply a screenshot. A phone may contain an application database and notification. The service may hold message and delivery events. A native chat export may organise the conversation into a readable file. These are related records, not interchangeable copies of one perfect original; first establish whether the item is a screenshot, export, notification or provider record.

The most useful conclusion often comes from comparing screenshots and exports with device or provider records. Agreement between a victim’s device, service records and a suspect device is more persuasive than endlessly enlarging one screenshot.

What a message record may establish¶

Depending on the source and service, a message record may establish:

• the content associated with a message or conversation;
• the sending and receiving accounts recorded by the service;
• message, thread or group identifiers;
• precise timestamps and service-generated status events;
• attachments, edits, reactions, deletions or forwarding events;
• the relationship between a message and a device copy or provider record.

It can support evidence of threats, instructions, knowledge, agreement or a sequence of events. The proposition should match what the particular record reliably contains.

Sent, delivered and read are system states¶

Those events are useful, and the linked cards explain precisely what sent, delivered and read or seen mean. They do not necessarily prove personal attention or comprehension. A linked laptop might generate a read event while the telephone owner is elsewhere; a notification may reveal content without opening the conversation.

Authorship requires a bridge to the person¶

The bridge may be built from account access, recurring device identifiers, possession, local artefacts, surrounding conversation, distinctive knowledge, payment activity and conduct before or after the message. These are practical sources of corroboration for message authorship. An account-sharing or compromise explanation can then be tested against those facts.

The answer is not to append “but anyone could have sent it” to every report. It is to state what is established, identify the remaining attribution question and pursue the evidence capable of answering it. Where independent provider, victim-device and suspect-device records agree, investigators should say plainly that the combined evidence strongly supports authorship.