What is the overall investigator checklist for messaging, social-platform and telecoms evidence?¶

Messaging, Social Media & Telecoms Checklist

Use this when you are pulling a messaging or social-platform enquiry together and want to make sure the obvious gaps have been dealt with.

The main thing is to avoid treating the chat screen as the whole story. A message may sit alongside account records, linked devices, provider data, telecoms records, backups and other participants' copies.

1. Be clear what you are dealing with¶

[ ] Identify the service or platform.
[ ] Record the account, username or telephone number involved.
[ ] Identify the device or devices you currently know about.
[ ] Record the conversation, group, channel or call involved.
[ ] Fix the relevant date and time period.
[ ] Keep any stable account, message, conversation or device IDs you can see.

If the visible identity is doing too much work in the investigation, step back and ask whether you are looking at an account, a number, a device or a person.

2. Preserve the state before you start poking around¶

Before opening, reconnecting or changing anything, record what is on screen and how the device or account is connected.

Useful things to note include:

unread or read state;
notifications;
disappearing-message settings;
linked devices;
group membership and roles;
visible account identifiers;
active calls or sessions; and
whether the device is online.

Some interactions can create new receipts, synchronise changes, consume disappearing content or alert somebody else.

That does not mean “do nothing”. It means know what you are trying to achieve before you touch it.

3. Keep the useful identifiers¶

[ ] Account or user ID
[ ] Telephone number
[ ] Message ID
[ ] Conversation or thread ID
[ ] Group or channel ID
[ ] Call ID where available
[ ] SIM or subscriber identifier
[ ] Device or linked-device identifier
[ ] Session or login identifier
[ ] Exact timestamps and time zone

Friendly names change. Stable identifiers give you something much better to match across provider returns, devices and other records.

4. Work out what the evidence actually shows¶

Try to keep these questions separate:

Question	What you need to think about
What did the account do?	Send, receive, edit, delete, join, leave, call or change settings
Which device or session was involved?	Local device, linked client, web session, remote access or automation
Who controlled it at the time?	Possession, login, device use and wider corroboration
Was it delivered or read?	Platform-specific message state and recipient-side records
Did somebody participate?	Group membership, activity and actual interaction are not the same thing

This is usually where a messaging enquiry becomes much clearer. You stop asking “who sent this message?” as one big question and break it into things the available records can actually answer.

5. Keep the surrounding context¶

Do not preserve one interesting message and throw away everything around it.

Where it matters, keep:

surrounding messages;
attachments and media;
edits and deletions;
delivery or read states;
calls;
location or sharing events;
group membership changes;
replies and quoted messages; and
any obvious linked account or device activity.

A single line of chat can look very different once you can see what happened before and after it.

6. Look beyond the device in front of you¶

Messaging evidence is often spread around.

Useful other sources may include:

another participant's device;
linked or companion devices;
the service provider;
telecommunications records;
backups;
cloud accounts;
employer or organisational systems; and
network or authentication records.

If one source is missing or unclear, another may answer the same question from a different angle.

7. Test the realistic alternatives¶

You do not need to invent every possible explanation. Test the ones that genuinely fit the case.

That might include:

shared use of an account or device;
account compromise;
number reassignment;
linked-device activity;
automation or bots;
forwarding;
synchronisation from another device; or
somebody receiving rather than creating the content.

The point is not to make every finding sound uncertain. It is to avoid spending time and resources on the wrong explanation when one realistic alternative is still staring you in the face.

The most common mistakes in messaging investigations is a useful check if the account, device and person are starting to blur together.

8. Know when to get specialist help¶

Get help before doing something that might:

consume disappearing content;
synchronise or delete data;
alert another user;
reconnect a deliberately isolated device;
alter an account or session;
change encryption or access state; or
make an important finding harder to reproduce later.

A specialist question is much easier to answer if you can say exactly what you have, what you want to know and what you are worried an action might change.

9. Decide whether the line of enquiry is still worth pursuing¶

Before doing more work, ask what the next record could actually change.

If another provider return, device, recipient copy or backup has a realistic chance of resolving an important question, it may be worth pursuing.

If the next step is only going to duplicate what you already know, has almost no prospect of recovery, or would not change the investigative decision, it may be time to stop.

When should a messaging line of enquiry stop? goes into that decision in more detail.

10. Report what you have actually established¶

By the end, another investigator should be able to see:

which account or number was involved;
which device or session was linked to the activity;
what the message or platform records actually show;
what supports personal control;
what remains uncertain;
which alternative explanations were tested; and
why the enquiry was continued, narrowed or stopped.

Try to avoid phrases such as “the phone proves” or “the account holder sent it” unless the evidence genuinely gets you that far.

A good final check is:

If another investigator picked this up tomorrow, could they see what happened, where the records came from, what is still open, and what the next sensible step would be?

If yes, the messaging line of enquiry is in a good state to move forward.