Does receiving an attachment prove that it was opened?¶

No. Delivery, download, application processing and deliberate viewing are different events. A file can reach a device and be stored or previewed without a person choosing to open it.

Applications may process media automatically¶

Settings can cause a messaging application to fetch complete files or partial data in the background. The application or operating system may cache content, create a thumbnail, index it or expose it to a gallery. Notification handling and synchronisation can produce further artefacts.

These processes explain presence on the device, but their exact operation depends on application version, settings, connectivity and file type. Access timestamps alone are unreliable indicators of human action because system processes, backup and examination can also update them.

Look for evidence of interaction¶

Preserve the message, attachment, download status, local path, preview, settings and relevant logs. Evidence supporting viewing might include opening in a viewer, full-size rendering, user navigation, saving, editing, forwarding, screenshotting or later messages referring to the content.

Interpret those traces together rather than treating any single artefact as decisive. Automatic previews demonstrate why even a recognisable image on the device may reflect processing rather than awareness.

Report delivery or local storage when that is all the evidence establishes. Attribute opening, viewing or knowledge only when additional records support the human action.