Evidential scenario
Two chat exports contain different messages
Differences must be normalised by account, device, application version, export method, time zone, deletion and acquisition date before manipulation is inferred.
Questions to resolve
Establish the fact base.
Q1
Were exports produced by the same method?
Q2
What were the device and application versions?
Q3
Are original devices and databases available?
Immediate actions
Preserve the available routes.
A1
Preserve both exports and their provenance
A2
Acquire underlying devices where authorised
A3
Compare identifiers, media hashes and service events
A4
Build a normalised chronology
Interpretation risks
Avoid premature conclusions.
Treating normal synchronisation as tampering
Comparing local times without conversion
Ignoring selectively exported context
Confidential case review
