What does “no relevant data found” actually mean?

Identify which stage produced the result

An unavailable device is not a negative search result. Failed account access is not an empty account. An acquisition that omitted an application does not establish that the application held no relevant data. A parser that did not recognise a record is different from a validated search of a successfully acquired source.

Record separately whether the source was available, whether acquisition succeeded, what the acquired material covered, whether processing completed and what the examination actually tested. This prevents an access limit being mistaken for a finding about human conduct.

Test the search boundary

State the relevant accounts, applications, dates, identifiers and content types. Consider whether the search relied only on keywords, whether images or voice notes were included, and whether spelling, language, aliases or timestamp conversion affected the result. These are questions to document, not reasons to assume hidden evidence must exist.

Consider other sources proportionately

A retained backup, an existing linked endpoint or another participant's device may address a gap, if available and lawfully accessible. Such sources may also be incomplete or dependent on the same original record. Further work should have a defined purpose rather than an open-ended promise of recovery.

Report a bounded conclusion

Illustrative wording, not a case finding: “No matching message was identified in the supplied export for the examined period using the documented searches. The original device and attachment files were not supplied. The result does not determine whether the communication existed outside this export.”

The example must be adapted to the actual examination. Both the work performed and the limits matter.