What are notifications and what can they reveal?¶

Notifications are alerts displayed by the operating system or an application.

What this means¶

They may show incoming messages, missed calls, account activity, payment events, location alerts, security warnings and app updates.

Notifications can be evidentially useful because they may preserve information no longer visible inside the app.

A deleted message may still appear in a notification record.

A preview may show the sender, part of the content and the time received.

Notifications can also indicate that an account was active on the device.

It may arrive while the phone is locked, unattended or being used by somebody else.

Several linked devices may receive the same alert.

Notification timestamps also need care.

They may reflect receipt, display, update or later synchronisation.

They may preserve content, timing and account links that have disappeared elsewhere.

The operational takeaway is: notifications can reveal incoming activity, previews and account use, but they show what the device displayed, not automatically what the user saw or did.

What to check or do next¶

• Investigators should compare notifications with app databases, provider records, message status and device-use records.
• Do not dismiss notifications as merely visual clutter.

Evidential limits¶

But a notification does not prove that the user opened, read or understood the content.

The displayed name may come from local contacts or an app profile and may not be verified.