Reference tables
Compare the
evidence routes.
Concise comparisons for orientation only. The actual result remains dependent on the device, application version, state and lawful access available.
Logical versus file-system acquisition
On a narrow screen, scroll the table horizontally.
| Question | Logical acquisition | File-system acquisition |
|---|---|---|
| Typical scope | Supported user data and services | Broader application and system containers |
| Deleted-data potential | Usually limited | May expose residual database and file artefacts |
| Device interaction | Method-dependent | Method-dependent and often more involved |
| Completeness | Not guaranteed | Not guaranteed |
| Best use | Focused accessible content | Deeper application and system analysis |
Screenshot versus underlying records
On a narrow screen, scroll the table horizontally.
| Feature | Screenshot | Application database |
|---|---|---|
| Shows visible wording | Where available | Usually |
| Internal identifiers | No | Often |
| Delivery, edit or deletion flags | Only if displayed | Application-dependent |
| Conversation context | Selected by capturer | Potentially broader |
| Can prove authorship alone | No | No |
Application deletion versus factory reset
On a narrow screen, scroll the table horizontally.
| Effect | Application deleted | Device factory reset |
|---|---|---|
| Primary app database | May be removed | Normally cryptographically inaccessible |
| Media outside app | May remain | Normally removed from device |
| Cloud or backup sources | May remain | May remain |
| Linked desktops | May remain | May remain |
| Recipient evidence | May remain independently | May remain independently |
Messaging evidence source map
On a narrow screen, scroll the table horizontally.
| Application | Local device | Cloud or backup | Desktop or linked device |
|---|---|---|---|
| Where available | Configured backup | Where available | |
| Where available | Migration or backup varies | Where available | |
| Signal | Where available | Optional encrypted backup; key and compatibility required | Where available |
| Telegram | Cache and secret chats | Cloud chats | Where available |
| Apple Messages | Where available | iCloud or backup | Apple ecosystem |
| LINE | Where available | Configured backup | Potentially |
Three copies are not necessarily three sources
| Material compared | What correspondence may support | What it does not establish alone |
|---|---|---|
| A screenshot and a PDF made from that screenshot | Consistency between two representations | Independent confirmation of the conversation |
| An export and a report generated from the same export | Consistency within one processing chain | Completeness of the original account or correctness of the parser |
| Separately acquired participant records | Corroboration where source histories and relevant fields are established | Human authorship or the absence of synchronisation and shared-source effects |
Record how each item was created and whether it depends on another item. Independence is a property to assess, not a label earned by having different filenames.
Confidential case review
