Mobile evidence guidance
Can message timestamps and read receipts be relied upon?
They can be important, but their meaning depends on the application schema, time zone, device clock, server behaviour, synchronisation and acquisition method. Sent, delivered, read, edited and deleted times are different events.
Potential evidence sources
Where relevant records may exist.
- Underlying message database
- Device time-zone configuration
- Application service events
- Server or cloud records where available
- Counterpart device
- Export and screenshot metadata
Decision factors
What materially changes the prospects.
- 01UTC versus local display
- 02Clock changes and daylight saving
- 03Message status definition
- 04Offline delivery and later synchronisation
- 05Database conversion by forensic tools
Evidential limitations
What must not be overstated.
Displayed time may be transformed from stored time
Read receipts can be disabled or absent
Tool output should be checked against underlying values
Sources and interpretation
Each entry identifies its limited supporting proposition and documentation-check date. General methodology is not a current device-support list. These checks are not laboratory validation; availability and method suitability require assessment for the exact source and configuration.
- NIST mobile device forensics guidance
Methodological background (2014), not a current device-support list.
General methodology · Documentation checked
- NIST IR 8354: Digital Investigation Techniques, final scientific foundation review (2022)
Methodological background: discovery is not exhaustive and changing software can change artefact meaning. Not a device-support list.
General methodology · Documentation checked
Confidential case review
