Mobile Extractions Offender Viewpoint

Dodgy Dave deletes the wildlife-trade chat and keeps the thumbnails¶

Dave uses a messaging app to arrange the unlawful sale of protected wildlife. After each handover he deletes the conversation and checks the screen looks tidy. The extraction later contains notification fragments, thumbnail images, account identifiers and location searches. Dave has cleaned the shop window and left several storerooms untouched.

The working principle

Deleting the visible conversation changes one view of the data. Databases, notifications, media caches, recipient devices and provider records may retain related evidence, but each surviving artefact still needs its own source and meaning.

Protected wildlife

Messaging account

Deleted chat

Cached media

Handover records

Dave and buyer

Dave develops a one-button retention policy¶

Dave uses account marshrunner to advertise two protected birds and arrange a handover under reference WILD-208. He deletes the conversation from his phone after the buyer confirms collection. “Deleted” in an extraction is a technical state to interpret, not a promise that every trace is gone - or recoverable.

Parsed message artefact

extraction=X-908 · exhibit=H-55account_id=marshrunnerconversation_id=WILD-208message_row=4418 · parser_state=deletednotification_fragment=“same lay-by · 19:40”

Established the extraction produced this account, conversation and notification-linked result from handset H-55Still open who authored the message, how deletion occurred and what part of the conversation is missing

The report preserves the source path and database row. An application database or parser can be incomplete or wrong, but that possibility is tested against the source and surrounding evidence rather than used to make the result disappear.

The photographs have smaller relatives¶

Dave removes the full-size photographs from the visible gallery. The messaging cache retains thumbnails with file identifiers matching attachment records in the surviving database. Cached and thumbnail images may be reduced, transformed or separated from their original context; they can still link a device to an application event or provide a hash comparison.

Related extraction artefacts

ThumbnailTH-8821source: RelayChat media cache

Attachment recordATT-551conversation: WILD-208

NotificationNTF-3314account: marshrunner · 19:32:08 UTC

Related artefacts may share one underlying event; count the sources, not the icons

The thumbnail, attachment row and notification are useful but may all derive from the same message. They should not be described as three independent confirmations. A recipient handset preserving attachment ATT-551 is a genuinely separate source and supplies the complete message thread.

Dave's map search keeps the appointment¶

The extraction records a map search for the handover location and a navigation event ending shortly before 19:40. A separate photograph in the buyer's thread carries a different timestamp and source. Mobile location records need their field meaning and precision understood; a searched location is not the same thing as a device position.

19:18:22 UTCMap application records a search for the named lay-by.

19:32:08 UTCOperating system records notification NTF-3314.

19:40:51 UTCBuyer's device records receipt of attachment ATT-551.

19:47:16 UTCRoad camera records Dave's van leaving the location.

The timeline preserves what each system recorded. A timestamp does not by itself prove when a person acted, but the precise sequence across independent sources is a strong line of enquiry.

The account and device acquire an owner through evidence¶

Dave's handset contains the marshrunner account, the relevant cache and the navigation history. The provider records the account on the same application installation. The buyer identifies their own account and the conversation. Road footage shows Dave's van, and a later lawful recovery finds packaging carrying reference WILD-208 at his premises.

EstablishedHandset, recipient, provider, camera and recovered-item evidence converges on the conversation and handover under reference WILD-208.

Still openDave's account, the provenance of the wildlife, the buyer's knowledge and whether another person used the account or vehicle.

This is stronger than “deleted material was recovered”. The case joins sourced artefacts to an independently preserved conversation, provider event, physical movement and recovered reference. What corroboration to seek before attribution is answered through specific agreement, not a vague request for “more evidence”.

What Dave's tidy screen did not settle¶

ConversationDatabase and recipient evidence preserve account, message and attachment identifiers.

Device contextNotifications, cache and map records place related activity on Dave's handset.

HandoverBuyer, camera and recovered-item evidence independently support the meeting sequence.

ResponsibilityThe combined evidence strongly points towards Dave while preserving enquiries into supply and the buyer's role.

Operational takeaway

Dave deleted a conversation view, not the history of every system involved. Preserve each artefact's source, avoid counting related parser results as independent evidence, and look for recipient, provider and real-world records that confirm the underlying event.

General investigator methodTurn a reader report into a sourced, corroborated case →Foundation explanationUnderstand extraction, processing and reader-report layers →