When should a messaging line of enquiry stop?¶

Stop when further work is unlikely to obtain relevant evidence capable of materially changing the investigative assessment, and record why the enquiry was narrowed or closed.

Define what the next record could decide¶

Begin with the unresolved proposition: content, timing, account activity, endpoint origin or personal authorship. Identify what additional source could support or distinguish the competing explanations and whether it is likely to remain available.

Continue where a relevant and proportionate provider return, recipient copy, endpoint, backup or organisational record has a realistic prospect of resolving that issue. Difficulty caused by encryption, deletion or account complexity is not itself a reason to stop if another source can answer the question.

Recognise diminishing evidential value¶

Further work may be unnecessary when it would duplicate established evidence, has little prospect of recovery or could not affect the decision. Consider timeliness, available authority, privacy impact, safeguarding and resource implications alongside evidential value.

Avoid broad searches without a defined purpose, but do not hide a material gap by calling it disproportionate. Record the evidence already obtained, the potential source considered, expected value, constraints and reason for continuing, narrowing or closing the line.