Mobile evidence guidance
Can an examiner identify whether a message was edited?
Some applications record edit status, edit time or prior-related identifiers; others expose only the current content. Database records, exports, notifications and counterpart devices can help determine what is supportable.
Potential evidence sources
Where relevant records may exist.
- Application message database
- Edit flags and service events
- Notifications containing earlier text
- Exports created at different times
- Counterpart devices
- Quoted replies and screenshots
Decision factors
What materially changes the prospects.
- 01Application and version
- 02Whether edit history is retained
- 03Acquisition timing
- 04Database schema interpretation
- 05Availability of comparison sources
Evidential limitations
What must not be overstated.
An edit label may not preserve the previous wording
Absence of an edit flag is not universal proof of no change
Exports may flatten or omit edit metadata
Sources and interpretation
Each entry identifies its limited supporting proposition and documentation-check date. General methodology is not a current device-support list. These checks are not laboratory validation; availability and method suitability require assessment for the exact source and configuration.
- NIST mobile device forensics guidance
Methodological background (2014), not a current device-support list.
General methodology · Documentation checked
- NIST IR 8354: Digital Investigation Techniques, final scientific foundation review (2022)
Methodological background: discovery is not exhaustive and changing software can change artefact meaning. Not a device-support list.
General methodology · Documentation checked
Confidential case review
