Could an artefact have been created automatically?¶
Yes. Applications, operating systems and cloud services create messages, files, notifications, thumbnails and logs without a person performing an action at that moment. A genuine, accurately interpreted artefact does not therefore always represent deliberate human activity at its timestamp.
How automatic artefacts are created¶
Applications synchronise in the background, while operating systems create indexes, previews, notifications and logs. Cloud services download content; messaging applications generate delivery and read-status updates; security products scan links or files; and workflows can create events on a schedule.
Automation may also have been configured by a user. A scheduled message, shortcut, rule or third-party application can act later without the user touching the handset then. The relevant human action may have occurred when the process was configured, authorised or triggered.
Identify the process and trigger¶
Establish what normally creates the record:
- direct user input;
- receipt of data from a server;
- application launch;
- background synchronisation;
- a scheduled process; or
- an earlier account or system event.
Source fields, application behaviour and device state may distinguish manual, system or background activity. Foreground application use, a typed draft, button event, unlock record or associated local file may support direct interaction. Activity while the device was locked, or a sequence showing a background process waking and completing a task, may support automation.
Provider and application audit logs may identify the triggering event, the account or process with authority and who configured it.
Move human attribution to the right event¶
Automation does not necessarily remove responsibility. A person may configure a forwarding rule, schedule a post or change a record that causes a standard message to be sent. Conversely, a notification can contain algorithmically selected content, an image can be prefetched and a suggestion can be displayed without deliberate interest or knowledge.
A clear conclusion identifies both the software event and the available human link:
The application created this message automatically when the account status changed. Audit records link that status change to a user session thirty seconds earlier.
Another record may justify only the narrower finding:
The operating system generated the thumbnail during background media indexing; no evidence of deliberate opening was identified.
Key takeaway
Explain which process created the artefact and whether it was manual, automatic or triggered by an earlier action before describing human behaviour.
Related questions¶
- What does an application artefact actually show?
- What does a timestamp prove about when a person acted?
- Does data on the phone prove the user knew it was there?
