What is the difference between draft, queued, sent, delivered and read?¶
title: What is the difference between draft, queued, sent, delivered and read? subtitle: These states describe different stages in a communication process and may be recorded by different systems. slug: what-is-the-difference-between-draft-queued-sent-delivered-and-read series: mobile-extraction-and-reader-reports section: interpreting-common-artefacts card_type: question_card content_type: core-operational risk_level: high-risk pathway_order: 30 section_order: 5 status: draft owner: IF Digital last_updated: '2026-07-25' version: '0.1' review_gate: pending review_mode: ai-assisted review_timebox_mins: 60 qa_gate: pending qa_count: 0 pipeline_ref: PIPELINE_PRG_001 pipeline_version: '1.1' public_safe: true video_ready: true word_count: 510 estimated_read_time_seconds: 211 audiences: - investigator - supervisor - fraud and compliance practitioner tags: - mobile evidence - message status - draft - delivered - read sources: - title: SWGDE Best Practices for Mobile Device Forensic Analysis url: https://www.swgde.org/documents/published-complete-listing/20-f-005-swgde-best-practices-for-mobile-device-forensic-analysis/ - title: 'NIST SP 800-101 Rev. 1: Guidelines on Mobile Device Forensics' url: https://csrc.nist.gov/pubs/sp/800/101/r1/final - title: 'NIST Computer Forensics Tool Testing: Mobile Devices' url: https://www.nist.gov/itl/csd/secure-systems-and-applications/computer-forensics-tool-testing-program-cftt/cftt-7
What is the difference between draft, queued, sent, delivered and read?¶
These states describe different stages in a communication process and may be recorded by different systems.
Script¶
Message applications may record several stages between composition and human reading.
The labels sound straightforward.
Their exact meaning depends on the application and which system recorded them.
A draft is content saved before submission.
It may have been typed manually, generated automatically, restored from a backup or synchronised from another device.
A draft does not prove that the user intended to send it or that it left the device.
Queued normally means the application has accepted the message for later submission but has not completed the next stage.
The device may be offline.
The application may be waiting for a connection, authentication or background process.
A queued record does not establish successful delivery.
Sent can have several meanings.
It may mean the local application handed the message to its service.
It may mean the provider accepted it.
In some systems, the friendly label is generated from a local status field rather than independent confirmation from the server.
Where the distinction matters, identify the source.
Delivered normally means the service recorded that the message reached a recipient account or device according to its own rules.
It does not necessarily prove that the intended person saw it.
The recipient account may be shared.
The device may be unattended.
A server may mark delivery before the application displays the message.
Read normally means the service or application received a read or display event.
It may result from opening a conversation, previewing a message, synchronising through another client or an automated process.
It does not prove that a particular human read and understood the content.
Some applications add other states:
failed;
cancelled;
expired;
deleted;
edited;
recalled;
played;
opened;
or acknowledged.
Don't translate those labels using assumptions from another platform.
Start with the application’s own status model and the source values exposed by the forensic tool.
Also identify who recorded the state.
A draft and queued state may exist only on the sending device.
A delivered or read state may be synchronised back from the provider.
A notification may show one status while the main database shows another.
A backup may preserve an earlier state that later changed.
Time matters as well.
The message may have a creation time, submission time, server time, delivery time and read time.
The report may display only one of them or convert them into a local timezone.
Don't label the first visible timestamp as “time sent” without checking the field.
The common mistake is:
“It says sent, so the recipient received it.”
Sent and delivered are different stages.
Another is:
“It says read, so the suspect personally read it.”
The record may show that the service received a read event from an account or client.
Human attention is a further inference.
A careful conclusion might say:
“The application database records the message as submitted by the sender account. A separate synchronised status records delivery to the recipient account five seconds later.”
That describes the evidence without collapsing the stages.
Message states are process markers.
Understand the source and application before turning them into statements about human behaviour.
Key takeaway
A later state usually implies earlier processing, but the exact meaning depends on the application and source that recorded it.
Related questions¶
- Does a message in the report prove it was sent or received?
- What does it mean when data is marked parsed or decoded?
- Could cloud-linked data have come from another device?
Source notes¶
- SWGDE Best Practices for Mobile Device Forensic Analysis
- NIST SP 800-101 Rev. 1: Guidelines on Mobile Device Forensics
- NIST Computer Forensics Tool Testing: Mobile Devices