What are notifications and what can they reveal?¶
Notifications are operating-system or app alerts that can preserve previews, sender labels, account activity, calls, payments, location and security events.
They may outlast source content¶
A deleted message can remain in notification records. The timestamp may describe receipt, display, update or later synchronisation. Linked devices can receive the same alert, and names may come from unverified contacts or profiles.
Display does not prove awareness¶
Compare notifications with app databases, provider events, message status and device use. An alert can arrive while locked, unattended or in another person's hands. It shows what the device displayed, not automatically what its user opened or understood.
Key takeaway
Preserve notifications as volatile display and account evidence and corroborate both the underlying event and human awareness.
