How should screenshots and exports be compared with device or provider records?¶

Align records by stable identifiers, source and event sequence before comparing wording or time. Each representation may observe a different stage, so a discrepancy can be explanatory evidence rather than proof that one source is false.

Build a cross-source map¶

Use account, telephone, username, message, thread and group IDs instead of display names alone. Record provenance and collection time for the screenshot, export, device database, notification and provider return.

Compare content, attachments, edits, deletion markers and status events. Keep the strongest source for each proposition: a recipient device may preserve content; provider logs may establish transmission or account identity; capture evidence explains provenance.

Explain differences, do not smooth them¶

Preserve original time values and establish whether each represents creation, acceptance, delivery, display or export in UTC or local time. Allow for device clocks, conversion and synchronisation.

A screenshot may pre-date an edit, a notification retain deleted wording, an export omit system events or a linked device lag behind. Record each mismatch and test its likely mechanism. Only after that comparison should records be joined into a common timeline.