What exactly have I been given: a screenshot, export, notification or provider record?¶

Identify the evidence form before interpreting the communication. Screenshots, notifications, native exports, device artefacts, extraction reports and provider records are related representations that preserve different content, metadata and context.

Each form answers a different question¶

• A screenshot records what appeared on a display at capture time.
• A notification is a device or application alert, often only a preview.
• A native export contains what the service's export function made available.
• A device artefact may include databases, caches, thumbnails, logs or remnants.
• An extraction report presents acquired device data through forensic software.
• A provider record may hold account, message, delivery or subscriber events, though encrypted content may be unavailable.

None is automatically the complete conversation or the original source of every displayed field.

Preserve provenance and compare representations¶

Record source, collector, device or account, capture or export method, date and time, software and options. Preserve the original file or package and associated metadata before conversion.

Compare important content and identifiers with the source device, other participant, provider or another representation. Explain discrepancies rather than selecting whichever display seems clearest.