What messaging metadata may exist when the provider cannot read the content?¶

A provider that cannot read message content may still hold records about the account, its endpoints and communication events. These operational records are metadata: evidence about activity rather than the words, images or meaning exchanged.

Records arise from running the service¶

Depending on the platform and retention period, records may include account identifiers, registration details, linked telephone numbers or emails, device and session identifiers, IP-related login data, security changes and linked-device events.

Event data may record sending, acceptance or delivery times, sender and recipient accounts, calls, group membership or administrative changes. Field names do not have universal meanings: a provider's created, sent and delivered values may refer to different stages and time bases.

Obtain original records with field definitions where possible. Preserve the request, response, relevant identifiers and stated retention or time-zone information.

Metadata supports bounded propositions¶

These records may show that two accounts interacted, that a session existed, or that an event occurred at a recorded time. They do not necessarily show the message content, its meaning, the originating device or the person operating the account.

Compare metadata with handset and network evidence, recipient copies, device artefacts and account-security records. Report the exact event supported, rather than translating it into an unsupported claim about authorship or intent.