Could opening a message alter the evidence?¶

Yes. Opening a live message can create service and device events, change synchronised state or consume volatile content. Record what exists before interacting and distinguish later investigative actions from pre-existing evidence.

Viewing can trigger several mechanisms¶

The application may record read or seen status, download attachments, generate previews, reorder the conversation or update last-active information. A request can move into the main inbox, and linked endpoints or the sender may receive the changed state.

View-once or disappearing content can start a timer or become unavailable after display. Opening suspicious links or attachments can add security and operational risk beyond the evidential change.

Preserve a before-and-after record¶

Capture the device, account, application and message identifiers, observation time, connectivity, notification, unread state and visible preview. Screenshots or photographs can document appearance but should not replace native preservation where available.

If interaction is necessary, plan the capture method, record the reason and authority, and document each step and resulting event. Where behaviour is uncertain, obtain appropriate specialist support before testing it on the evidential message.