Dodgy Dave runs an anonymous harassment campaign¶

Dave wants to frighten a former colleague, Maya Reed, without having to stand behind his words. He creates an anonymous social-media account, sends direct messages and then moves to an encrypted messaging service. Dave believes changing apps twice qualifies as vanishing.

This card follows Dave’s harassment campaign and the communications evidence it creates. The investigator walkthrough explains preservation, provider records and authorship.

Dave creates an anonymous audience of one¶

Dave follows Maya’s public account and sends messages referring to a disagreement known within their former team. The visible username is disposable. The provider’s account, thread and message identifiers are the more durable references connecting the service events.

The references to the meeting and entrance are not proof of authorship, but they narrow the relevant knowledge and can be compared with witnesses, access records and Dave’s communications.

Dave changes service¶

Dave directs Maya to encrypted-chat account EC-66104, where he sends a doctored photograph of her car and several voice messages. End-to-end encryption may prevent the provider from supplying readable content. It does not mean no evidence exists.

Messaging metadata may remain available even where content is encrypted. Maya’s device preserves the received messages and attachments; Dave’s device may preserve the sending account, drafts, local copies and the original image used to create the doctored version.

Dave develops a recognisable style¶

Across both services, the messages use the same unusual phrase - “actions acquire consequences” - and arrive shortly after Maya leaves an evening class. Dave has used the phrase in earlier workplace messages because he once heard it in a courtroom drama and has been waiting for a suitable occasion.

Wording alone would be a modest line of enquiry. Wording combined with the service hand-off, precise timing, distinctive workplace knowledge and corresponding device artefacts can become strong circumstantial evidence. The relevant route is corroboration of message authorship, not linguistic guesswork dressed as certainty.

Dave deletes what he can see¶

Dave deletes the social account and clears the encrypted conversation from his phone. Maya’s screenshots, notifications and live conversation remain. Provider-held account and message events may remain according to each service’s design and retention. A device examination may also identify deleted fragments, cached attachments or the account configuration.

Dave cannot infer what survives merely by looking at an empty chat screen. Neither should an investigator: first establish what kind of messaging record has been supplied and compare victim, provider and device sources.

What Dave changed - and what he did not¶

Dave’s anonymity is a proposition to test, not a property bestowed by his username. When independent service, victim-device, suspect-device and real-world records converge, the resulting circumstantial case may be very strong.