Securing evidence properly: what later actually counts

A cropped image of a message leaves open who it came from, when it arrived and in what context it stood. Therefore secure complete views with a visible address, date and time, and export chat histories as a file or archive where the application permits it. For emails the technical headers are decisive, because they document the transmission path – they are lost when the message is photographed.

Do not alter original files – no renaming of attachments, no retouching of images, no deletion of messages that appear irrelevant. Store copies separately from the original and note where each file comes from. Content already deleted can sometimes still be reconstructed; mention it therefore, rather than passing over it.