What are the most common mistakes in messaging investigations?¶

The most common mistakes collapse different evidential layers: account into person, storage into sending, delivery into awareness, and service status into human action.

Familiar interfaces hide technical context¶

A display name is not a stable identity, a telephone number is not automatically its user, and possession at seizure does not prove earlier control. Group membership does not establish participation, while linked endpoints, account sharing, compromise and automation can separate an account event from a person.

Screenshots may be accepted without provenance or native records. Current participant lists can be mistaken for historical membership, provider summaries used without fields or definitions, and encryption described either as destroying all evidence or guaranteeing accessible backups.

Interaction can create the next mistake¶

Opening a message, reconnecting an endpoint or changing account settings can generate receipts, synchronise deletion, consume disappearing content or alert another user. Preserve identifiers, connectivity and visible state before interacting.

The corrective method is consistent but not mechanical: identify the exact question, preserve the available sources, distinguish account and endpoint events, reconstruct the relevant time, and corroborate human control. Report each proposition only at the level supported by its records.