Could opening a disappearing message destroy or change it?¶

Yes. View-once and disappearing features may start expiry, consume content or notify another participant when the item is opened. The unopened state is therefore part of the evidence.

Volatility depends on the feature¶

Some messages expire after a timer; others are removed after one view or after leaving the display. Opening may also download media, create a screenshot warning or synchronise the changed state to linked endpoints. Behaviour can depend on version, settings and whether the device is online.

Do not test the feature using the evidential item. A failed or partial first view may be the only opportunity to observe its content.

Prepare preservation before display¶

Record sender and recipient account IDs, message details, timer or view status, notification and visible preview. Consider other participant devices, notifications, thumbnails, attachments, backups and provider metadata that may preserve related evidence.

Where opening is justified, agree an appropriate capture method before acting and document the complete process and resulting changes. Report whether the content was preserved, observed once or reconstructed from another source rather than implying a repeatable original remains.