Overview
A screenshot may show the sentence that matters. It may leave out who was actually participating, what came before the sentence, which attachment it referred to, or whether the conversation continued elsewhere. When a messaging exchange could affect a dispute or an internal decision, preserve the available source material before reducing the conversation to a handful of images.
Mobile evidence requires an app-specific, device-specific assessment. SMS, MMS, iMessage, WhatsApp, WeChat, Telegram, and Signal do not create a single uniform evidence source. The phone model, operating system, app version, account configuration, and current device state can all influence the collection options. An examiner should explain those dependencies before promising a result.
Begin with the question the messages need to answer
“Collect all the texts” is often too vague to be useful. Define the issue first. Are you trying to establish when instructions were given, whether a person received an attachment, how a negotiation developed, or whether a produced transcript is complete?
Identify the people, accounts, approximate dates, and relevant business or legal issue. Include known alternative accounts and earlier phone numbers. Ask whether the conversation moved from one service to another. A short SMS exchange may direct the participants to a messaging app where the substantive discussion occurred.
This preparation helps shape a collection that preserves relevant context without treating every personal conversation as a proper subject of review. Counsel should address authority, privacy, privilege, and the applicable scope before access or collection begins.
What screenshots preserve and what they leave uncertain
Screenshots can preserve a useful visible record and should not be discarded. Keep the original image files when available, along with information about who captured them, when, and from which device or account. Avoid cropping or marking up the only retained copy.
However, the visible screen is only one presentation of a conversation. A contact label does not necessarily establish the account identifier. A cropped image may omit adjacent messages. The screenshot may show a preview rather than the full attachment. It may also be unclear which time-zone setting produced the displayed time.
Source collection can sometimes supply additional records against which to assess those uncertainties. That does not make every export complete or every extracted field conclusive. Ask the examiner what the collection contains, what it excludes, and how the important fields were interpreted.
Different messaging services require different questions
SMS and MMS
Identify the handset and messaging application used during the relevant period, as well as any replacement phones. Ask which account, SIM, or phone number was associated with the exchange. Separate message content from attachments and from any records obtained through other sources.
Do not assume a carrier record will reproduce the full conversation. Any provider request should be scoped through counsel and assessed for the particular service, record type, period, and lawful process. A phone bill, an app export, and a device collection may answer different questions.
iMessage
Determine which Apple devices were involved and whether Messages in iCloud was enabled. Apple documents that keeping Messages current across devices depends on account and feature settings. A second Apple device should therefore be assessed on its actual configuration rather than assumed to contain an identical history. Apple Set up iCloud for Messages (opens in a new tab)
Ask about the period before any device replacement or account change. Preserve relevant devices and existing backups before experimenting with synchronization or restoration.
Ask about the phone, linked devices, existing backups, and backup security settings. WhatsApp offers end-to-end encrypted backups, which makes the existence of a backup a separate question from whether it can be accessed through an authorized method. WhatsApp End-to-End Encrypted Backups (opens in a new tab)
An exported chat can be useful for review, but the examiner should identify its origin, selection settings, and treatment of media. Do not assume that the export provides every artifact that a supported device examination could make available.
Identify the exact app and version, the phone used during the relevant period, any desktop use, and known backup or migration history. Ask which conversations are visible now and whether the device was replaced, reset, or reinstalled.
Treat collection feasibility as a matter for assessment. Avoid relying on generic claims that all WeChat history lives in one place or that a provider can simply return a complete transcript. The appropriate evidence plan depends on the actual devices, accounts, permissions, and accessible records.
Telegram
Determine whether the relevant exchange used Cloud Chats or Secret Chats. Telegram describes Secret Chats as device-specific and outside its cloud; its FAQ also warns that logging out loses Secret Chats on that device. That distinction can materially change the preservation plan. Telegram FAQ Secret Chats (opens in a new tab)
Record the device on which the exchange occurred. Do not log out merely to prepare the phone for delivery to an examiner.
Signal
Ask about the installed version, original device, linked devices, and any enabled backup option. Signal's current documentation describes optional Secure Backups protected by a recovery key, with exclusions for certain disappearing or view-once messages. Statements that Signal never has any backup are therefore too broad. Signal Secure Backups (opens in a new tab)
Whether a particular backup exists, covers the relevant material, and can be lawfully accessed still requires verification. Never assume the account's phone number alone provides access to historical content.
Preserve the circumstances as well as the content
Before collection, make a short inventory of the relevant devices and accounts. Record who currently controls each device, whether it is powered on, and any known recent changes. Keep available chargers and identify existing backups without restoring them over a source device.
Ask for specific handling instructions promptly. Avoid exploratory activity such as reinstalling apps, upgrading software, cleaning storage, resetting a phone, or testing recovery utilities. These steps can change the material being examined. There is no universal instruction to turn every phone off, leave every phone online, or enable airplane mode; the appropriate handling depends on the situation and should be directed by the examiner.
NIST's mobile-forensics guidance provides a general framework for preservation, acquisition, examination, and reporting. Published in 2014, it is a foundational reference rather than a current compatibility list for today's apps or devices. NIST SP 800-101 Rev. 1 Guidelines on Mobile Device Forensics (opens in a new tab)
Preserve enough context to interpret the exchange
A useful review scope should consider:
- Messages immediately before and after the disputed passage.
- Participant identifiers and changes in group membership where available.
- Attachments and the messages associated with them.
- Replies, reactions, or edit indicators where the source and collection support them.
- Time-zone assumptions and the distinction between different timestamp fields.
- Gaps caused by collection scope, unavailable sources, or known retention settings.
These are review questions, not a guarantee that every app exposes every listed field. Agree on how missing information will be marked. A blank field should not silently become a negative finding.
Questions to ask a mobile forensic examiner
Can deleted messages be recovered?
Sometimes relevant material remains available in a source or existing backup, but recovery cannot be guaranteed. The answer depends on the device, application, changes since deletion, and supported collection methods. A proposal should state the uncertainty.
Can encrypted apps be examined?
Encryption does not make every authorized examination impossible, but it also does not mean an examiner can decrypt every app or bypass every locked device. Ask which method is being proposed and what access it requires.
Can the result identify who typed a message?
An account or device association may contribute to that assessment. It should not automatically be treated as proof of the human operator at a particular moment. Other evidence may be needed.
What should we receive at the end?
Ask for a clear description of the sources, collection scope, methods, relevant findings, and limitations, together with reviewable material appropriate to the engagement. The output should help a lawyer or business decision maker understand both what the evidence supports and what remains unresolved.
Plan the collection before the next device change
Contact DFI Forensics before a relevant phone is reset, replaced, or returned. Bring the key dates, app names, known devices, and the question you need answered. A scoped consultation can identify preservation priorities and determine whether a proposed collection is likely to produce useful evidence.
Collection options depend on the device, application version, access and records still available. DFI can assess those conditions before recommending a method.
