What evidence may corroborate message authorship?¶
The strongest authorship conclusion usually combines technical control of the sending endpoint with contextual evidence linking the composition and timing to a person.
Corroborate access and composition¶
Possession, unlock activity, biometrics, account logins, linked sessions, location, witnesses and contemporaneous photographs may connect a person to the device. Drafts, typing artefacts, clipboard activity, voice-input records, saved source files or earlier versions can show how content was prepared.
The conversation may contain personal knowledge, references to recent events, known relationships or language patterns. Follow-up conduct and immediate replies can support the surrounding narrative, although a recipient's belief about the sender does not independently establish authorship.
Look for convergence, not one decisive clue¶
Preserve the full conversation and relevant device and account records rather than isolating the disputed line. Assess each strand's limitations and whether it is genuinely independent.
Shared accounts, copied text, impersonation, scheduled messages and compromise can reproduce individual indicators. Linguistic style can assist across a sufficient body of material but should not substitute for endpoint and timing evidence. Report why the combined evidence supports the conclusion and what remains unresolved.
The point to remember
Corroborate authorship through independent evidence of account access, endpoint control, composition, timing and context rather than relying on the sender field alone.
