Evidence quality and confidence

Active database records

Structured content with identifiers and relationships can support context, but parsing and field meanings still need validation. An active database can itself be incomplete, synchronised or manipulated.

WAL, journals and freelists

These structures may retain changes or residual records. Establish the relation to the main database, transaction state, schema and acquisition time. Do not silently treat a fragment as a complete committed message.

Carved fragments

A fragment may lack sender, timestamp or conversation context. Validate its structure, avoid joining unrelated bytes and distinguish a recovered string from a reliably attributed message. A tool's deleted label is not proof of deliberate user deletion.

Caches, thumbnails and notifications

These can corroborate activity but may be stale, truncated, duplicated or detached from the original. A thumbnail is not the original image; a notification may not show the complete communication.

Screenshots and exports

Assess provenance, editability, surrounding conversation and correspondence with native records. A plausible screenshot or readable export is not self-authenticating.

Provider returns

Providers can transform media or omit fields. Preserve the returned representation and collection context. A changed hash compared with an original upload may reflect transformation rather than tampering.

Reporting confidence

For each material conclusion, identify the source, validation performed, gaps, corroboration and credible alternatives. State fact, inference and opinion separately. Do not assign unvalidated numerical confidence scores or infer human authorship solely from an account name.

Integrity is not the whole authenticity question

A matching cryptographic hash supports byte-for-byte consistency with the item hashed at that point in its history. It does not establish who created the original, whether its content is true or whether earlier material was omitted. Assess provenance, completeness, context and authorship separately.

A changed media file may reflect resizing, transcoding or metadata handling rather than fabrication. Record the supplied representation and investigate the transformation before drawing a conclusion.

Media metadata and provenance · Worked example: observation, inference and limitations