What should I do if the device is displaying notifications?¶

Notifications can provide useful evidence, but they are also volatile and easy to misinterpret.

What this means¶

A notification may show the app name, sender label, part of a message, time, account, missed call, security alert or background activity.

Notifications may be generated automatically. They may arrive late, repeat older activity, synchronise from another device or remain visible after the original content has changed or disappeared.

Opening it may mark content as read, acknowledge delivery, launch an app, trigger synchronisation, alter timestamps or reveal material outside the scope of the enquiry.

Also avoid clearing notifications. Their presence, order and timing may help explain what the device received and what was visible to a user.

A notification should be treated as a lead rather than a complete record. The underlying app, provider records, device databases, linked devices or cloud account may contain better evidence.

Consider whether the notification itself creates urgency. A remote-wipe warning, security alert, low-battery warning or active communication may require specialist advice quickly.

The operational takeaway is: record notifications exactly as displayed, do not open or clear them casually, and corroborate the visible alert with underlying device, account or provider evidence before drawing conclusions.

What to check or do next¶

• Record what is visible before touching the device.
• Note the date and time, the device state, whether it is locked or unlocked, the app involved, the wording shown and any other visible context. Photograph the screen where lawful and appropriate.
• Do not tap the notification simply to see more.

Evidential limits¶

That does not automatically prove that the device user opened the app, read the content or carried out the underlying action.