Does possession of the phone prove authorship of its messages?¶

title: Does possession of the phone prove authorship of its messages? subtitle: Possession supports access and opportunity; authorship requires evidence that the person composed, approved or triggered the particular communication. slug: does-possession-of-the-phone-prove-authorship-of-its-messages series: mobile-extraction-and-reader-reports section: evidential-limits-corroboration-and-supervision card_type: question_card content_type: core-operational risk_level: high-risk pathway_order: 52 section_order: 2 status: draft owner: IF Digital last_updated: '2026-07-25' version: '0.1' review_gate: pending review_mode: ai-assisted review_timebox_mins: 60 qa_gate: pending qa_count: 0 pipeline_ref: PIPELINE_PRG_001 pipeline_version: '1.1' public_safe: true video_ready: true word_count: 481 estimated_read_time_seconds: 199 audiences: - investigator - supervisor - fraud and compliance practitioner tags: - mobile evidence - authorship - messages - possession - attribution sources: - title: SWGDE Best Practices for Mobile Device Forensic Analysis url: https://www.swgde.org/documents/published-complete-listing/20-f-005-swgde-best-practices-for-mobile-device-forensic-analysis/ - title: 'NIST SP 800-101 Rev. 1: Guidelines on Mobile Device Forensics' url: https://csrc.nist.gov/pubs/sp/800/101/r1/final - title: 'Forensic Science Regulator: Interpretation and Communication (FSR-GUI-0004)' url: https://www.gov.uk/government/publications/forensic-science-activities-interpretation-and-communication-fsr-gui-0004

Does possession of the phone prove authorship of its messages?¶

Possession supports access and opportunity; authorship requires evidence that the person composed, approved or triggered the particular communication.

Script¶

Possession of a phone can be important evidence.

It does not automatically prove authorship of every message linked to the device or its accounts.

Separate four questions.

Who possessed or normally controlled the handset?

Which account sent or stored the message?

Which device or client submitted it?

Who composed, approved or triggered the words?

Those questions often point to the same person.

They don't always do so.

A message may have been typed on the handset and sent through an account controlled by the possessor.

It may also have been:

sent from a linked computer;

synchronised from another handset;

written by one person and sent by another;

generated from a template;

created by a workflow or application;

sent through a shared account;

or produced during account compromise.

Start with the message artefact.

Does the source identify direction, status, account, device or client?

Is there a local draft?

Was an attachment created on the handset?

Does keyboard, application-use or notification evidence support composition on the device?

Did the message appear only after synchronisation?

Can provider records identify the originating client or session?

Now consider the content.

Does it contain information known to the alleged author?

Does it use their normal style, spelling or references?

Did they respond consistently afterwards?

Was the message part of a wider exchange involving their verified accounts?

These factors may support authorship.

They should not be treated as a substitute for the technical source where stronger records are available.

Stylistic similarity is rarely exclusive.

A person can copy another’s wording.

Templates and suggested replies can imitate routine language.

An accomplice may know the same facts.

The device may also have been accessible to others.

Who knew the passcode?

Was it left unlocked?

Was it used within a household, vehicle, office or shared criminal enterprise?

Did somebody admit borrowing it?

Do location, CCTV, witness or device-use records place another person with it?

Avoid reversing the burden of proof.

The mere possibility that somebody else could have used the phone does not automatically defeat a strong attribution.

The alternative should be tested against the evidence.

Was there an actual opportunity?

Does the timing fit?

Are there signs of the other user or another device?

The common mistake is:

“The message came from the suspect’s phone, so the suspect wrote it.”

The evidence may establish account and device submission.

Authorship is the further claim.

Another mistake is:

“Anyone could have used the phone, so the message proves nothing.”

Secure possession, local composition traces, timing and content may make another user unrealistic.

A careful conclusion might say:

“The message was submitted through the account from the handset. A local draft and attachment created on the device immediately beforehand support composition on the handset. Possession and surrounding evidence link the handset to this person.”

That is a reasoned authorship assessment.

Possession supports opportunity and control.

Authorship requires evidence about the particular communication.

Separate possession of the device, control of the account, submission of the message and authorship of the words.

Related questions¶

• Can a mobile extraction identify the person using the phone?
• Does a message in the report prove it was sent or received?
• Could an artefact have been created automatically?

Source notes¶

• SWGDE Best Practices for Mobile Device Forensic Analysis
• NIST SP 800-101 Rev. 1: Guidelines on Mobile Device Forensics
• Forensic Science Regulator: Interpretation and Communication (FSR-GUI-0004)